T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:40
- Finding
- Predictable Shared Temporary File Allows Symlink-Based File Clobbering## Vulnerability Details **File Location**: `SKILL.md:40-60` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash # Save user input as a JSON file cat > /tmp/eval_input.json << 'EOF' { "location": { "property_clear": true, "license": true, "ventilation": true, "utilities": true, "fire_safety": true, "landlord": true, "demolition_risk": false, "daily_flow": 2500, "customer_match": "match", "rent_15_percent": true, "contract_3y": true, ... } } EOF # Run the evaluation python3 scripts/evaluate.py /tmp/eval_input.json ``` ### Technical Analysis The documented workflow stores user input at the fixed path `/tmp/eval_input.json`. Because `/tmp` is normally shared and writable by multiple local users, an attacker may create this pathname before the workflow runs. Shell output redirection opens the destination before executing `cat` and ordinarily follows symbolic links. If `/tmp/eval_input.json` is an attacker-created symbolic link, following the documented command can truncate and overwrite its target with the JSON content. The issue is a time-of-check/time-of-use and insecure temporary-file design flaw: the filename is predictable, it is not created atomically, ownership is not verified, and no private temporary directory is used. Even where operating-system symlink protections prevent the strongest exploit, simultaneous executions can overwrite one another's input, produce incorrect assessments, or expose input to other local users depending on the process umask and resulting permissions. ### Attack Path 1. The attacker has local access sufficient to create files or symbolic links in `/tmp`. 2. The attacker predicts the documented filename `/tmp/eval_input.json`. 3. Before the victim runs the workflow, the attacker creates a symbolic link: ```bash ln -s /path/to/victim-writable-target /tmp/eval_input.json ``` 4. The victim follows the Skill in ...[truncated 1362 chars]
- Remediation
- ## Remediation Suggestions Use an atomically created, private temporary file or directory rather than a fixed pathname. Apply restrictive permissions and guarantee cleanup. A hardened shell workflow could use: ```bash tmpdir="$(mktemp -d)" || exit 1 chmod 700 "$tmpdir" trap 'rm -rf -- "$tmpdir"' EXIT input_file="$tmpdir/eval_input.json" umask 077 cat > "$input_file" << 'EOF' { "location": { "property_clear": true, "license": true } } EOF python3 scripts/evaluate.py "$input_file" ``` Additional hardening measures: 1. Prefer accepting JSON through standard input so no intermediate file is required: ```bash python3 scripts/evaluate.py - ``` Update the Python script to read from `sys.stdin` when the argument is `-`. 2. If a file must be used, create it atomically with `mktemp`; never construct a predictable `/tmp` filename manually. 3. Set `umask 077` before writing potentially sensitive business or financial input. 4. Quote every generated pathname and remove it through a cleanup trap. 5. Do not run the workflow with elevated privileges. 6. If the script itself later creates temporary files, use Python's `tempfile.NamedTemporaryFile` or `tempfile.TemporaryDirectory` APIs.