T09 · Insecure Skill Coding Practices
Warning
- Location
references/flows/phase2-planning.md:7- Finding
Unsanitized Novel and Chapter Titles Are Used in Filesystem Paths
- Content
View full analysis
用户可通过 "Other" 自行输入标题。 ``` ```markdown - **命名项目目录**：`{base}/{timestamp}-{标题}/` ``` From `references/flows/phase2-planning.md`: ```markdown 1. **清理临时文件**：如果存在 `{base}/.pending-title`，读取标题后删除该文件 2. **创建项目文件夹**：`{base}/{YYYYMMDD-HHmmss}-{Layer 3 确认的标题}/` ``` From `references/flows/phase3-writing.md`: ```markdown 7. 创建章节文件 — 文件名格式：`第{XX}章-{章节标题}.md`，使用 [chapter-template.md](../guides/chapter-template.md) 模板 ``` ### Technical Analysis The workflow permits a user to enter an arbitrary custom novel title and then directly interpolates that title into a project directory path. Generated chapter titles are similarly interpolated into filenames. No rule requires normalization, filename character allowlisting, path canonicalization, or verification that the resulting path remains under `{base}` or `{projectPath}`. A title containing path separators, traversal components such as `..`, absolute-path syntax, control characters, or operating-system-specific reserved names can therefore alter the intended output location. The exact behavior depends on the filesystem API used by the hosting agent, but the Skill instructions themselves do not establish a containment boundary. The same issue can arise during interrupted-project recovery because persisted title and plan data are reused in later phases. ### Attack Path 1. The attacker selects the custom-title option. 2. The attacker supplies a title containing path separators or traversal components. 3. The title is written to `{base}/.pending-title`. 4. Phase 2 reads the title and constructs `{base}/{timestamp}-{title}/` without sanitization. 5. The agent ...[truncated 1029 chars]- Remediation
View remediation