T09 · Insecure Skill Coding Practices
- Location
data_harvester.py:170- Finding
Arbitrary Local File Read Through Unrestricted Batch File Path
- Content
View full analysis
Vulnerability Details
File Location:
data_harvester.py, lines 170–186
Vulnerability Type: Arbitrary local file read and information disclosure
Risk Level: MediumVulnerable Code:
python filepath = args[0] print(f"📦 批量抓取: {filepath}") print("\n⚠️ 此功能需要:") print(" 1. 创建一个文本文件，每行一个URL") print(" 2. 使用浏览器自动化抓取") print(" 3. 支持自定义CSS选择器") # 尝试读取文件 try: with open(filepath, 'r') as f: urls = [line.strip() for line in f if line.strip()] print(f"\n✅ 找到 {len(urls)} 个URL:") for url in urls[:5]: print(f" - {url}") if len(urls) > 5: print(f" ... 还有 {len(urls)-5} 个")Technical Analysis
The
batchcommand takes its file path directly from raw command arguments and passes it toopen()without validating or restricting the path. There is no canonical-path check, permitted base directory, file-extension restriction, symlink protection, regular-file verification, or content validation.Although this command is documented as accepting a text file containing URLs, any file readable by the Python process can be supplied. The implementation reads every nonempty line into memory and then returns the first five nonempty lines through command output. This creates both an information-disclosure risk and a potential resource-exhaustion condition when a very large or unusual file is selected.
Attack Path
- An attacker obtains the ability to provide arguments to the skill, directly or through prompt injection affecting a calling agent.
- The attacker invokes the batch command with a sensitive absolute or traversal-based path, such as
batch /path/to/sensitive-file. - The command passes the attacker-controlled path directly to
open(filepath, 'r'). - The process reads the selected file using its own operating-system privileges.
- Up to five nonempty lines are printed into the tool output and become visible to the caller.
- The attack ...[truncated 791 chars]
- Remediation
View remediation
Remediation Suggestions
- Store accepted batch files in a dedicated, non-sensitive workspace directory.
- Resolve the requested path with
Path.resolve()and verify that it remains beneath the permitted directory. - Reject absolute paths, traversal sequences, symlinks, directories, device files, pipes, and other non-regular files.
- Apply an explicit file-size limit before reading and process input incrementally rather than loading the entire file into memory.
- Require an approved file extension where appropriate.
- Validate each input line as an
httporhttpsURL before accepting or displaying it. - Avoid echoing file contents unless the output is necessary for the command.
- Run the skill under a dedicated least-privilege account that cannot access secrets or unrelated user files.
- Handle
PermissionError,OSError, decoding failures, and oversized input safely without exposing sensitive path details.