T09 · Insecure Skill Coding Practices
Error
- Location
hot_cache.py:25- Finding
Arbitrary JSON File Access Through Agent ID Path Traversal
- Content
View full analysis
Vulnerability Details
File Location:
hot_cache.py:25-105
Vulnerability Type: Path traversal leading to arbitrary file read, overwrite, and deletion
Risk Level: Highpython def _file_path(agent_id: str) -> Path: return CACHE_DIR / f"{agent_id}.json" def _load(agent_id: str) -> list: path = _file_path(agent_id) if path.exists(): try: return json.load(open(path)) except: return [] return [] def _save(agent_id: str, entries: list): json.dump( entries, open(_file_path(agent_id), 'w'), indent=2, ensure_ascii=False ) def clear_agent(agent_id: str): """Clear the HOT cache for an agent.""" path = _file_path(agent_id) if path.exists(): path.unlink() return True return FalseTechnical Analysis
The externally supplied
agent_idis interpolated directly into a filesystem path. The code does not restrict path separators, traversal components such as.., or absolute paths.pathlibtherefore permits the resulting path to escape~/.agent-mem/hot_cache.The unsafe path is used by three security-sensitive operations:
_load()reads and parses the selected JSON file._save()opens the selected file in write mode and replaces its contents.clear_agent()deletes the selected file.
Although the
.jsonsuffix limits the immediately reachable filenames, it does not prevent access to sensitive JSON files elsewhere in the account. The CLI exposes these operations through attacker-controlled--agentvalues.Attack Path
- An attacker obtains the ability to invoke the HOT-cache CLI or an application endpoint that passes an agent identifier to these functions.
- The attacker supplies an agent identifier containing an absolute path or traversal components, for example
../../other-directory/config. _file_path()const ...[truncated 820 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate agent identifiers against a strict allowlist such as
^[A-Za-z0-9_-]{1,64}$. - Reject absolute paths, path separators,
.components, and..components. - Resolve the destination and verify containment before every operation:
python import re AGENT_ID_PATTERN = re.compile(r"^[A-Za-z0-9_-]{1,64}$") def _file_path(agent_id: str) -> Path: if not AGENT_ID_PATTERN.fullmatch(agent_id): raise ValueError("Invalid agent ID") base = CACHE_DIR.resolve() path = (base / f"{agent_id}.json").resolve() if path.parent != base: raise ValueError("Cache path escapes the cache directory") return path- Use atomic writes through a temporary file created inside
CACHE_DIR, followed byos.replace(). - Create cache files with restrictive permissions such as
0600. - Apply authorization checks so callers can access only their permitted agent IDs.
- Add regression tests covering absolute paths, nested paths, URL-encoded separators, and
../traversal.
- Validate agent identifiers against a strict allowlist such as