T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-weekly-report.mjs:197- Finding
Unrestricted Overwrite of Caller-Selected Report Files
- Content
View full analysis
/^\d+$/.test(a)) || '7'); const outputPath = args.find(a => a.endsWith('.md') || a.endsWith('.txt')) || null; const report = generateWeeklyReport(daysArg, outputPath); ``` ### Technical Analysis The script accepts any command-line argument ending in `.md` or `.txt` as its output path and passes it directly to `fs.writeFileSync`. The path is not resolved against a dedicated report directory, checked for traversal, restricted to relative filenames, or tested for an existing destination. `fs.writeFileSync` opens the destination in truncating write mode by default. Consequently, an existing writable file is replaced without warning. Absolute paths and traversal paths such as `../../state.md` are accepted as long as the resulting target ends in an allowed extension. The extension check does not establish a security boundary. It only limits the final filename suffix and does not prevent access to sensitive text-based state, documentation, Agent instructions, or configuration files. ### Attack Path 1. An attacker or untrusted automation gains influence over the arguments passed to `generate-weekly-report.mjs`. 2. The attacker supplies an absolute path or traversal path to an existing writable `.md` or `.txt` file. 3. The script identifies that argument as `outputPath`. 4. `generateWeeklyReport` passes the path unchanged to `fs.writeFileSync`. 5. The target file is truncated and replaced with generated report content. Example invocation: ```bash node scripts/generate-weekly-report.mjs 7 ../../target.md ``` ### Impact Assessment ...[truncated 531 chars]- Remediation
View remediation