T09 · Insecure Skill Coding Practices
- Location
SKILL.md:303- Finding
Predictable Temporary Files Permit Symlink-Based File Overwrite and Cross-Run Interference
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:303-307,SKILL.md:357-360,SKILL.md:404-407,SKILL.md:513-515, andSKILL.md:579-586
Vulnerability Type: Predictable temporary file usage and unsafe extraction directory
Risk Level: MediumVulnerable Code
bash PDF_URL=$(echo $REPORT_RESULT | jq -r '.data') echo "PDF URL: $PDF_URL" # 4. Download PDF file curl -s -o /tmp/research_result.pdf "$PDF_URL"The same predictable PDF path is used again:
bash PDF_URL=$(echo $REPORT_RESULT | jq -r '.data') # Download PDF file curl -s -o /tmp/research_result.pdf "$PDF_URL"The background execution example uses another fixed path:
bash PDF_URL=$(curl -s 'https://desearch.zeelin.cn/api/conversation/to_report?sessionId=${SESSION_ID}&reportType=pdf' \ -H 'x-api-key: ${API_KEY}' | jq -r '.data') curl -s -o /tmp/report.pdf "$PDF_URL"The Feishu workflow uses predictable input, output, and extraction paths:
bash WORD_URL=$(echo $REPORT_RESULT | jq -r '.data') # 4. Download Word file curl -s -o /tmp/research.docx "$WORD_URL" # 5. Extract text from the Word file unzip -q /tmp/research.docx -d /tmp/research_docx/ sed 's/<[^>]*>//g' /tmp/research_docx/word/document.xml | tr -s ' \n' > /tmp/research.txtTechnical Analysis
The documented workflows write downloaded reports to fixed, shared paths under
/tmp, including/tmp/research_result.pdf,/tmp/report.pdf,/tmp/research.docx,/tmp/research.txt, and/tmp/research_docx/. They do not securely create these paths, verify file ownership, reject symbolic links, or isolate concurrent executions.On systems where another local process or user can create entries in
/tmp, an attacker can pre-create one of the expected output files as a symbolic link to another file writable by the Agent.curl -oopens the resolved destination and can therefore overwrite the symlink target with down ...[truncated 2040 chars]- Remediation
View remediation
Remediation Suggestions
-
Create a unique private temporary directory for every invocation:
bash umask 077 TMP_DIR=$(mktemp -d) || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT INT TERM -
Store all downloaded and generated files beneath that directory:
bash PDF_PATH="$TMP_DIR/research_result.pdf" DOCX_PATH="$TMP_DIR/research.docx" EXTRACT_DIR="$TMP_DIR/research_docx" TEXT_PATH="$TMP_DIR/research.txt" -
Do not reuse fixed
/tmppaths across users, tasks, or concurrent executions. -
Create output files with exclusive semantics where possible, and verify that destinations are regular files owned by the current Agent account. Reject symbolic links before processing or sending files.
-
Create the extraction directory with restrictive permissions and ensure it did not exist previously:
bash mkdir -m 700 "$EXTRACT_DIR" || exit 1 unzip -q "$DOCX_PATH" -d "$EXTRACT_DIR" -
Validate downloaded reports before processing them, including HTTPS scheme, approved host, maximum size, expected MIME type, and format signature.
-
Keep each task's temporary directory private until delivery is complete, then remove it through the cleanup trap.
-
Before sending or publishing a report, confirm that the file is a non-symlink regular file located within the task-specific temporary directory.
-