T09 · Insecure Skill Coding Practices
Warning
- Location
- install.sh:63
- Finding
- Shell Installer Follows a Pre-Existing Destination Symlink and Recursively Deletes Its .git Directory<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:63-68` **Vulnerability Type**: Symlink traversal with unsafe recursive deletion **Risk Level**: Medium ### Vulnerable Code ```bash install_to() { mkdir -p "$1/$SKILL_NAME" cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/" rm -rf "$1/$SKILL_NAME/.git" echo "installed -> $1/$SKILL_NAME" } ``` ### Technical Analysis The installer assumes that `$1/$SKILL_NAME` is an ordinary directory under the selected installation destination. It does not inspect the existing path with `lstat`, resolve it to a canonical path, or verify that the resolved target remains beneath the user-selected directory. If an attacker can create `yotta-workflow` as a symbolic link inside a shared or attacker-controlled destination, `cp -r` can write through that link into another writable directory. The subsequent `rm -rf` operation then removes `.git` under the linked destination. Shell quoting prevents ordinary argument-based command injection, but it does not prevent filesystem redirection through a pre-existing symlink. The recursive deletion is particularly risky because it is performed without canonical containment validation. ### Attack Path 1. An attacker obtains write access to a skill directory that the victim will use, such as a shared project-level agent directory. 2. The attacker creates a symlink: ```text <skills-directory>/yotta-workflow -> <writable-victim-directory> ``` 3. The victim runs: ```bash bash install.sh --dir <skills-directory> ``` 4. `mkdir -p` accepts the existing symlinked path. 5. `cp -r` copies the Skill files through the symlink and overwrites matching files in the victim directory. 6. `rm -rf "<skills-directory>/yotta-workflow/.git"` resolves beneath the linked directory and deletes the victim directory's Git metadata. Successful exploitation requires the victim process to have write permission to the linked destination. ### Impact Assessment An attacker can redirec ...[truncated 607 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Inspect the destination with `lstat` before writing and refuse symbolic links. 2. Canonicalize both the selected parent and final target using `realpath`. 3. Verify that the canonical final target is strictly contained within the canonical selected parent. 4. Install into a newly created temporary directory under the verified parent and atomically rename it into place. 5. Avoid recursive deletion in an unverified path. If `.git` must be excluded, omit it during copying rather than deleting it afterward. 6. Refuse installation when the destination already exists as an unexpected file type. 7. Add regression tests covering: - A symlinked `yotta-workflow` destination. - A symlinked parent component. - A destination containing `.git`. - Paths containing spaces and traversal components. ]]>