T09 · Insecure Skill Coding Practices
- Location
SKILL.md:40- Finding
Predictable Shared Temporary File Allows Symlink-Based File Clobbering
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:40-60
Vulnerability Type: Unsafe temporary-file handling
Risk Level: MediumVulnerable Code
bash # Save user input as a JSON file cat > /tmp/eval_input.json << 'EOF' { "location": { "property_clear": true, "license": true, "ventilation": true, "utilities": true, "fire_safety": true, "landlord": true, "demolition_risk": false, "daily_flow": 2500, "customer_match": "match", "rent_15_percent": true, "contract_3y": true, ... } } EOF # Run the evaluation python3 scripts/evaluate.py /tmp/eval_input.jsonTechnical Analysis
The documented workflow stores user input at the fixed path
/tmp/eval_input.json. Because/tmpis normally shared and writable by multiple local users, an attacker may create this pathname before the workflow runs.Shell output redirection opens the destination before executing
catand ordinarily follows symbolic links. If/tmp/eval_input.jsonis an attacker-created symbolic link, following the documented command can truncate and overwrite its target with the JSON content. The issue is a time-of-check/time-of-use and insecure temporary-file design flaw: the filename is predictable, it is not created atomically, ownership is not verified, and no private temporary directory is used.Even where operating-system symlink protections prevent the strongest exploit, simultaneous executions can overwrite one another's input, produce incorrect assessments, or expose input to other local users depending on the process umask and resulting permissions.
Attack Path
- The attacker has local access sufficient to create files or symbolic links in
/tmp. - The attacker predicts the documented filename
/tmp/eval_input.json. - Before the victim runs the workflow, the attacker creates a symbolic link:
bash ln -s /path/to/victim-writable-target /tmp/eval_input.json - The victim follows the Skill in ...[truncated 1362 chars]
- The attacker has local access sufficient to create files or symbolic links in
- Remediation
View remediation
Remediation Suggestions
Use an atomically created, private temporary file or directory rather than a fixed pathname. Apply restrictive permissions and guarantee cleanup.
A hardened shell workflow could use:
bash tmpdir="$(mktemp -d)" || exit 1 chmod 700 "$tmpdir" trap 'rm -rf -- "$tmpdir"' EXIT input_file="$tmpdir/eval_input.json" umask 077 cat > "$input_file" << 'EOF' { "location": { "property_clear": true, "license": true } } EOF python3 scripts/evaluate.py "$input_file"Additional hardening measures:
-
Prefer accepting JSON through standard input so no intermediate file is required:
bash python3 scripts/evaluate.py -Update the Python script to read from
sys.stdinwhen the argument is-. -
If a file must be used, create it atomically with
mktemp; never construct a predictable/tmpfilename manually. -
Set
umask 077before writing potentially sensitive business or financial input. -
Quote every generated pathname and remove it through a cleanup trap.
-
Do not run the workflow with elevated privileges.
-
If the script itself later creates temporary files, use Python's
tempfile.NamedTemporaryFileortempfile.TemporaryDirectoryAPIs.
-