T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:303
- Finding
- Predictable Temporary Files Permit Symlink-Based File Overwrite and Cross-Run Interference## Vulnerability Details **File Location**: `SKILL.md:303-307`, `SKILL.md:357-360`, `SKILL.md:404-407`, `SKILL.md:513-515`, and `SKILL.md:579-586` **Vulnerability Type**: Predictable temporary file usage and unsafe extraction directory **Risk Level**: Medium ### Vulnerable Code ```bash PDF_URL=$(echo $REPORT_RESULT | jq -r '.data') echo "PDF URL: $PDF_URL" # 4. Download PDF file curl -s -o /tmp/research_result.pdf "$PDF_URL" ``` The same predictable PDF path is used again: ```bash PDF_URL=$(echo $REPORT_RESULT | jq -r '.data') # Download PDF file curl -s -o /tmp/research_result.pdf "$PDF_URL" ``` The background execution example uses another fixed path: ```bash PDF_URL=$(curl -s 'https://desearch.zeelin.cn/api/conversation/to_report?sessionId=${SESSION_ID}&reportType=pdf' \ -H 'x-api-key: ${API_KEY}' | jq -r '.data') curl -s -o /tmp/report.pdf "$PDF_URL" ``` The Feishu workflow uses predictable input, output, and extraction paths: ```bash WORD_URL=$(echo $REPORT_RESULT | jq -r '.data') # 4. Download Word file curl -s -o /tmp/research.docx "$WORD_URL" # 5. Extract text from the Word file unzip -q /tmp/research.docx -d /tmp/research_docx/ sed 's/<[^>]*>//g' /tmp/research_docx/word/document.xml | tr -s ' \n' > /tmp/research.txt ``` ### Technical Analysis The documented workflows write downloaded reports to fixed, shared paths under `/tmp`, including `/tmp/research_result.pdf`, `/tmp/report.pdf`, `/tmp/research.docx`, `/tmp/research.txt`, and `/tmp/research_docx/`. They do not securely create these paths, verify file ownership, reject symbolic links, or isolate concurrent executions. On systems where another local process or user can create entries in `/tmp`, an attacker can pre-create one of the expected output files as a symbolic link to another file writable by the Agent. `curl -o` opens the resolved destination and can therefore overwrite the symlink target with down ...[truncated 2040 chars]
- Remediation
- ## Remediation Suggestions 1. Create a unique private temporary directory for every invocation: ```bash umask 077 TMP_DIR=$(mktemp -d) || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT INT TERM ``` 2. Store all downloaded and generated files beneath that directory: ```bash PDF_PATH="$TMP_DIR/research_result.pdf" DOCX_PATH="$TMP_DIR/research.docx" EXTRACT_DIR="$TMP_DIR/research_docx" TEXT_PATH="$TMP_DIR/research.txt" ``` 3. Do not reuse fixed `/tmp` paths across users, tasks, or concurrent executions. 4. Create output files with exclusive semantics where possible, and verify that destinations are regular files owned by the current Agent account. Reject symbolic links before processing or sending files. 5. Create the extraction directory with restrictive permissions and ensure it did not exist previously: ```bash mkdir -m 700 "$EXTRACT_DIR" || exit 1 unzip -q "$DOCX_PATH" -d "$EXTRACT_DIR" ``` 6. Validate downloaded reports before processing them, including HTTPS scheme, approved host, maximum size, expected MIME type, and format signature. 7. Keep each task's temporary directory private until delivery is complete, then remove it through the cleanup trap. 8. Before sending or publishing a report, confirm that the file is a non-symlink regular file located within the task-specific temporary directory.