T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/bootstrap-extra-files.py:21- Finding
Unrestricted Import of Attacker-Influenced Content into the Trusted Skill Root
- Content
View full analysis
Path | None: """获取私有工作区路径""" private_path = os.getenv('CNB_PRIVATE_WORKSPACE') if private_path: return Path(private_path).expanduser().absolute() return None def link_private_files(private_dir: Path, target_dir: Path) -> list[str]: """ 将私有目录的文件链接到目标目录 Args: private_dir: 私有目录路径 target_dir: 目标目录路径 Returns: 已链接的文件列表 """ linked_files = [] if not private_dir.exists(): print(f"⚠️ 私有目录不存在: {private_dir}") return linked_files for item in private_dir.iterdir(): if item.is_file(): target = target_dir / item.name if not target.exists(): try: # 优先使用软链接，失败则复制 target.symlink_to(item) linked_files.append(item.name) print(f"✅ 已链接: {item.name}") except OSError: # 不支持软链接时使用复制 shutil.copy2(item, target) linked_files.append(item.name) print(f"✅ 已复制: {item.name}") else: print(f"⏭️ 跳过已存在: {item.name}") elif item.is_dir(): # 目录也链接 target = target_dir / item.name if not target.exists(): try: target.symlink_to(item) linked_files.append(f"{item.name}/") print(f"✅ 已链接目录: {item.name}/") except OSError: shutil.copytree(item, target) linked_files.append(f"{item.name}/") print(f"✅ 已复制目录: {item.name}/") ``` ### Technical Analysis The post-install hook accepts `CNB_PRIVATE_WORKSPACE` directly from the process envir ...[truncated 2817 chars]- Remediation
View remediation