T09 · Insecure Skill Coding Practices
- Location
run.sh:9- Finding
Predictable Temporary Report Enables Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
run.sh:9andscripts/analyzer.py:613-615
Vulnerability Type: Unsafe predictable temporary file handling
Risk Level: MediumVulnerable Code
run.sh:9:bash python3 "$SCRIPT_DIR/scripts/analyzer.py" --root "$WORKSPACE_ROOT" --output /tmp/workspace-analysis.jsonscripts/analyzer.py:613-615:python if args.output: with open(args.output, 'w') as f: f.write(output_json)Technical Analysis
The launcher always writes its report to the fixed, shared path
/tmp/workspace-analysis.json. The analyzer then opens that path in write mode without checking whether it is a symbolic link, verifying ownership, or creating the file exclusively.On Unix-like systems,
open(path, 'w')follows symbolic links and truncates the resolved target. A local attacker who can create the predictable path before the victim invokesrun.shcan replace it with a symbolic link to another file writable by the victim. The analyzer will subsequently truncate and replace that target with generated JSON.Exploitation requires local access to the shared temporary directory and a target file that the process executing the skill is permitted to write.
Attack Path
- A local attacker predicts the fixed output path
/tmp/workspace-analysis.json. - Before the victim runs the skill, the attacker creates that path as a symbolic link to a file writable by the victim:
bash ln -s /path/to/victim-writable-file /tmp/workspace-analysis.json - The victim invokes
run.sh. - The launcher passes the attacker-controlled symbolic-link path to
analyzer.py. open(args.output, 'w')follows the link and truncates the target.- The analyzer overwrites the target with the generated JSON report.
Impact Assessment
The attacker can cause truncation and replacement of files writable by the account running the skill. Possible consequences include configuration corruption, loss of user data, a ...[truncated 255 chars]
- A local attacker predicts the fixed output path
- Remediation
View remediation
Remediation Suggestions
-
Create a unique report file with
mktemprather than using a fixed shared path:bash umask 077 REPORT_FILE="$(mktemp "${TMPDIR:-/tmp}/workspace-analysis.XXXXXX.json")" || exit 1 python3 "$SCRIPT_DIR/scripts/analyzer.py" \ --root "$WORKSPACE_ROOT" \ --output "$REPORT_FILE" -
Prefer a private runtime or cache directory owned by the invoking user instead of a globally shared directory.
-
Harden file creation in Python by using exclusive creation when a new output is expected:
python with open(args.output, "x", encoding="utf-8") as f: f.write(output_json) -
Where supported, use low-level file creation with
O_CREAT | O_EXCL | O_NOFOLLOWand restrictive permissions such as0600. -
If overwriting user-selected output files is required, use
lstatto reject symbolic links and verify the destination's ownership and type before writing. -
Ensure all failure paths terminate safely and do not fall back to the predictable filename.
-