T09 · Insecure Skill Coding Practices
- Location
SKILL.md:31- Finding
Unsanitized Customer Name Used in Filesystem Path
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–35
Vulnerability Type: Path Traversal / Arbitrary File Write
Risk Level: MediumVulnerable Code
text In `clients/{customer name}/`, create: - `config.json` - Configuration file - `notes.md` - Customer notes - `invoice.md` - QuotationThe snippet above is an English translation of the original instructions at the specified location.
Technical Analysis
The Skill instructs the agent to construct a directory path by inserting a customer-controlled name into
clients/{customer name}/. It does not require validation, sanitization, canonicalization, or verification that the resolved destination remains beneath the intendedclients/directory.A name containing path separators,
..components, or an absolute path could therefore escape the intended directory. The three generated files could then be created in, or overwrite files within, another writable project or workspace location. Symlink-based redirection is also not addressed.Attack Path
- An attacker submits an onboarding request and provides a crafted customer name, such as
../../skills/target. - The agent substitutes that value directly into the documented
clients/{customer name}/path. - The resulting path resolves outside the intended
clients/directory. - The agent creates
config.json,notes.md, andinvoice.mdin the attacker-selected writable directory. - If files with those names already exist and overwrite protection is absent, their contents may be replaced.
Impact Assessment
Exploitation does not directly grant privileges beyond those already held by the agent process. Within those privileges, however, an attacker may cause arbitrary creation or replacement of the three fixed filenames in unintended writable locations.
The affected scope includes the current workspace and any other filesystem paths writable by the agent. Potential c ...[truncated 313 chars]
- An attacker submits an onboarding request and provides a crafted customer name, such as
- Remediation
View remediation
Remediation Suggestions
- Convert the customer-visible name into a separate safe identifier rather than using it directly as a path component.
- Enforce a strict allowlist, such as
^[A-Za-z0-9_-]{1,64}$, and reject path separators, absolute paths, empty values,.and... - Join the validated identifier to a fixed
clientsbase directory and canonicalize the destination. - Verify that the canonical destination is a strict descendant of the canonical
clients/directory before creating files. - Reject existing symbolic links in every destination path component, or use filesystem operations that do not follow symlinks.
- Create new files with exclusive-creation semantics and require explicit authorization before overwriting existing records.
- Store the original customer name only as escaped data inside the generated files, not as an untrusted filesystem path.
- Document failure behavior so the agent refuses unsafe names instead of attempting to normalize ambiguous traversal input.