T09 · Insecure Skill Coding Practices
- Location
scripts/generate_gongwen.py:166- Finding
Unrestricted File Overwrite Through User-Controlled Output Path
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_gongwen.py, lines 166-168
Vulnerability Type: Arbitrary file overwrite through an unvalidated path
Risk Level: Mediumpython output_path = config['output_path'] doc.save(output_path) return output_pathTechnical Analysis
The script reads
output_pathdirectly from the caller-supplied JSON configuration and passes it toDocument.save()without validating or constraining the destination. There is no canonical path resolution, allowed-directory enforcement, filename sanitization,.docxextension check, or protection against overwriting an existing file.Both absolute paths and path traversal sequences can therefore target any writable location accessible to the process. Because
Document.save()writes a DOCX archive and replaces an existing destination, targeting an unrelated file can corrupt or destroy that file.Attack Path
- An attacker supplies or influences the JSON configuration processed by the script.
- The attacker sets
output_pathto an absolute path or traversal path, such as../../target-file. - The Agent invokes
generate_gongwen.pyusing that configuration. - The script passes the attacker-controlled path directly to
doc.save(). - If the process has write permission, the target is created or overwritten with DOCX data.
Impact Assessment
Exploitation is limited to the filesystem privileges of the process running the Skill; it does not independently elevate privileges. Within that boundary, an attacker could overwrite user documents, application data, configuration files, or other writable resources. The result could include data loss, configuration corruption, or denial of service. More serious consequences may be possible if the process can overwrite a security-sensitive file that another component later consumes.
- Remediation
View remediation
Remediation Suggestions
- Define a dedicated output directory controlled by the application.
- Resolve the requested path to its canonical absolute form and verify that it remains beneath the allowed directory.
- Reject absolute paths and traversal outside the permitted directory.
- Require a
.docxextension and sanitize user-controlled filenames. - Refuse to overwrite existing files by default, using exclusive creation or an explicit overwrite authorization.
- Generate a safe server-side filename when the destination originates from untrusted input.
- Run the generator with minimal filesystem permissions.
Example validation pattern:
python from pathlib import Path output_root = Path("/approved/output/directory").resolve() requested_name = Path(config["output_path"]) if requested_name.is_absolute(): raise ValueError("Absolute output paths are not permitted") output_path = (output_root / requested_name).resolve() if output_root not in output_path.parents: raise ValueError("Output path escapes the approved directory") if output_path.suffix.lower() != ".docx": raise ValueError("Output file must use the .docx extension") if output_path.exists(): raise FileExistsError("Refusing to overwrite an existing file") doc.save(str(output_path))