T09 · Insecure Skill Coding Practices
Error
- Location
- bin/agentsource.py:115
- Finding
- Predictable and Insecure Temporary Files Expose Sensitive Prospect Data<![CDATA[ ## Vulnerability Details **File Location**: `bin/agentsource.py:37, 115-123` **Vulnerability Type**: Predictable temporary files, unsafe file creation, and insufficient access controls **Risk Level**: High ### Vulnerable Code ```python TEMP_DIR = pathlib.Path("/tmp") ``` ```python def make_temp_path(command: str) -> pathlib.Path: ts = int(time.time()) return TEMP_DIR / f"agentsource_{ts}_{command}.json" def write_result(command: str, data: dict) -> pathlib.Path: path = make_temp_path(command) path.write_text(json.dumps(data, indent=2, default=str)) print(str(path)) return path ``` ### Technical Analysis The CLI stores imported CSV records and API results directly under the shared `/tmp` directory. Filenames contain only the current timestamp with one-second resolution and the command name, making them predictable. `Path.write_text()` does not provide exclusive file creation and follows an existing symbolic link. The code also does not explicitly set result files to mode `0600`; their permissions depend on the process umask and may commonly become `0644`. These files can contain sensitive B2B and personal information, including: - Names and employer information - Professional or personal email addresses - Phone numbers - LinkedIn profiles - Imported user CSV records - Enrichment and event results The implementation does not create a private per-user temporary directory, use cryptographically random filenames, prevent symbolic-link traversal, enforce restrictive permissions, or implement explicit cleanup. ### Attack Path 1. A local attacker monitors or predicts when the victim will run a CLI command. 2. The attacker derives a likely filename such as `/tmp/agentsource_<timestamp>_fetch.json`. 3. The attacker either: - Waits for the result to be created and reads it if its permissions allow access; or - Pre-creates that path as a symbolic link to another file writable by the victim. 4. The victim executes the Agen ...[truncated 971 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace timestamp-based paths with secure, exclusive temporary-file creation: ```python import os import tempfile fd, path_str = tempfile.mkstemp( prefix=f"agentsource_{command}_", suffix=".json", dir=private_temp_dir, text=True, ) try: os.fchmod(fd, 0o600) with os.fdopen(fd, "w", encoding="utf-8") as output: json.dump(data, output, indent=2, default=str) except Exception: os.close(fd) raise ``` 2. Create a per-user temporary directory with mode `0700` instead of writing directly into shared `/tmp`. 3. Ensure all result files are explicitly mode `0600`, independent of the process umask. 4. Use exclusive creation and never reopen a predictable path in a way that follows pre-existing symbolic links. 5. Add an explicit retention policy and cleanup command. Do not rely solely on unspecified operating-system cleanup. 6. Consider allowing users to select a protected output directory when processing regulated or highly sensitive contact information. ]]>