T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:172- Finding
Predictable Temporary File May Expose Sensitive HTTP Debug Data
- Content
View full analysis
&1 | tee /tmp/api-debug.log # Key things to capture: # - Request URL, method, headers, body # - Response status code, headers, body # - Timing information # - Any redirect chain ``` ### Technical Analysis The skill recommends capturing verbose `curl` output, request and response headers, and request and response bodies in the fixed path `/tmp/api-debug.log`. In realistic debugging sessions, this material can contain authorization headers, session cookies, API tokens, personal data, or other confidential application content. A predictable path in a shared temporary directory creates several risks: - Another local user may monitor or read the resulting file if its permissions are insufficiently restrictive. - An attacker may pre-create `/tmp/api-debug.log` as a symbolic link, potentially causing `tee` to overwrite a file writable by the process running the command. - A previous capture may be overwritten or remain accessible after debugging. - The use of `curl -v` increases the amount of potentially sensitive protocol metadata recorded. - The instructions provide no redaction, secure file creation, permission control, retention limit, or cleanup requirement. The issue does not independently grant elevated privileges. Exploitation is constrained by the operating-system permissions of the user executing the command and by the attacker's local access. ### Attack Path 1. A local attacker predicts that the documented debugging workflow will write to `/tmp/api-debug.log`. 2. The attacker monitors that path or pre-creates it as a file or symbolic link. 3. An operator or a ...[truncated 1188 chars]- Remediation
View remediation
"$debug_file" printf 'Diagnostic output saved to: %s\n' "$debug_file" ``` This safer example should still be accompanied by explicit instructions to omit secrets, sanitize captured content, and securely delete the file after use. ]]>