T09 · Insecure Skill Coding Practices
- Location
SKILL.md:186- Finding
Runtime Plan Data Overwrites the JSON Schema Definition
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 186 and lines 279–280
Vulnerability Type: Destructive overwrite of a packaged configuration asset
Risk Level: MediumRelevant instruction excerpts, translated into English:
markdown After generation, save the result as a JSON file following the structure of `assets\daily_plan_schema.json` and overwrite the file.markdown ### Output target - `assets\daily_plan_schema.json` — The daily-plan JSON data-structure definition; overwrite this schema during output.Technical Analysis
assets/daily_plan_schema.jsonis a JSON Schema definition used as a validation contract, not an appropriate destination for generated runtime data. The instructions explicitly direct the Agent to overwrite that packaged schema with a user's generated daily plan.This conflates immutable application configuration with mutable user data. Once the workflow reaches daily-plan generation, a compliant Agent may destroy the original schema and replace it with an instance document. Subsequent executions can then lose schema validation, behave inconsistently, or fail when attempting to interpret plan data as a schema.
The behavior can also persist user-provided task names, schedules, dependencies, goals, and notes inside the Skill package. If that directory is backed up, shared, packaged, or committed to source control, the data could be retained or disclosed beyond the user's expected planning session.
Attack Path
- A user invokes the Skill and supplies task or scheduling information.
- The workflow proceeds through collection, decomposition, and daily-plan generation.
- At step 5, the Agent follows the overwrite instruction in
SKILL.md. - The Agent writes the generated plan into
assets/daily_plan_schema.json. - The original schema is destroyed and replaced by user-derived runtime data.
- Later runs may fail validation, consume malformed confi ...[truncated 1016 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove every instruction that directs the Agent to overwrite
assets/daily_plan_schema.json. - Treat files under
assets/as immutable Skill resources. - Write generated plans to a distinct runtime destination, such as
output/daily_plan.json, a per-user application-data directory, or a user-selected path. - Validate generated plan data against
assets/daily_plan_schema.jsonbefore saving it. - Require explicit user approval before persisting plan data outside the current response.
- Avoid storing user-derived data in source-controlled or distributable project directories.
- Use unique or atomic output files to prevent partial writes and accidental replacement of existing data.
- Add a regression test confirming that daily-plan generation does not modify any file under
assets/. - Restore the instruction at lines 279–280 to describe the schema as a read-only validation input rather than an output target.
- Remove every instruction that directs the Agent to overwrite