cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [Security] Path traversal vulnerability in Agent Skills discovery #7051

New issue

Open

opened 2026-04-10 07:27:03 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-10 07:27:03 +00:00

Owner

Bug Report: [Security] — Path Traversal Vulnerability in Agent Skills Discovery

Severity Assessment

Impact: Unauthorized file system access, potential information disclosure
Likelihood: Medium - requires malicious skill folder structure with symlinks
Priority: High

Location

File: src/cleveragents/skills/agent_skills_loader.py
Function/Class: _discover_subdir
Lines: ~680-690

Description

The Agent Skills discovery mechanism uses rglob("*") without properly validating that discovered paths remain within the intended skill folder boundaries. Symbolic links could potentially be followed to access files outside the skill directory structure.

Evidence

In _discover_subdir function:

def _discover_subdir(folder: Path, subdir: str) -> list[Path]:
    sub_path = folder / subdir
    if not sub_path.exists() or not sub_path.is_dir():
        return []
    
    files: list[Path] = []
    for item in sorted(sub_path.rglob("*")):  # BUG: No path validation
        if item.is_file():
            files.append(item)  # Could include files outside intended boundary

Additionally, in _build_resource_slots:

slots.append(
    AgentSkillResourceSlot(
        name=subdir,
        resource_type=f"agent_skill_{subdir}",
        access="read_only",
        path=str(sub_path),  # BUG: Unvalidated path
    )
)

Expected Behavior

All discovered files and paths should be validated to ensure they remain within the skill folder boundary and don't traverse to unauthorized locations.

Actual Behavior

The system may follow symbolic links and access files outside the intended skill directory, potentially exposing sensitive system files or configuration.

Suggested Fix

Add path validation to ensure discovered files remain within boundaries:

def _discover_subdir(folder: Path, subdir: str) -> list[Path]:
    sub_path = folder / subdir
    if not sub_path.exists() or not sub_path.is_dir():
        return []
    
    # Get the absolute, resolved base path
    base_path = sub_path.resolve()
    files: list[Path] = []
    
    for item in sorted(sub_path.rglob("*")):
        if item.is_file():
            # Ensure the resolved path is within the base directory
            resolved_item = item.resolve()
            try:
                resolved_item.relative_to(base_path)
                files.append(item)
            except ValueError:
                # Path is outside the base directory, skip it
                logger.warning("Skipping path outside skill boundary: %s", resolved_item)
                continue
    return files

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be
created for TDD. The test will use tags: @tdd_issue, @tdd_issue_,
and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter
Worker Type: Module Scanner | Tag: [Bug Hunt Cycle 2 Batch 3] | Worker: 18 Skills Framework

## Bug Report: [Security] — Path Traversal Vulnerability in Agent Skills Discovery ### Severity Assessment - **Impact**: Unauthorized file system access, potential information disclosure - **Likelihood**: Medium - requires malicious skill folder structure with symlinks - **Priority**: **High** ### Location - **File**: `src/cleveragents/skills/agent_skills_loader.py` - **Function/Class**: `_discover_subdir` - **Lines**: ~680-690 ### Description The Agent Skills discovery mechanism uses `rglob("*")` without properly validating that discovered paths remain within the intended skill folder boundaries. Symbolic links could potentially be followed to access files outside the skill directory structure. ### Evidence In `_discover_subdir` function: ```python def _discover_subdir(folder: Path, subdir: str) -> list[Path]: sub_path = folder / subdir if not sub_path.exists() or not sub_path.is_dir(): return [] files: list[Path] = [] for item in sorted(sub_path.rglob("*")): # BUG: No path validation if item.is_file(): files.append(item) # Could include files outside intended boundary ``` Additionally, in `_build_resource_slots`: ```python slots.append( AgentSkillResourceSlot( name=subdir, resource_type=f"agent_skill_{subdir}", access="read_only", path=str(sub_path), # BUG: Unvalidated path ) ) ``` ### Expected Behavior All discovered files and paths should be validated to ensure they remain within the skill folder boundary and don't traverse to unauthorized locations. ### Actual Behavior The system may follow symbolic links and access files outside the intended skill directory, potentially exposing sensitive system files or configuration. ### Suggested Fix Add path validation to ensure discovered files remain within boundaries: ```python def _discover_subdir(folder: Path, subdir: str) -> list[Path]: sub_path = folder / subdir if not sub_path.exists() or not sub_path.is_dir(): return [] # Get the absolute, resolved base path base_path = sub_path.resolve() files: list[Path] = [] for item in sorted(sub_path.rglob("*")): if item.is_file(): # Ensure the resolved path is within the base directory resolved_item = item.resolve() try: resolved_item.relative_to(base_path) files.append(item) except ValueError: # Path is outside the base directory, skip it logger.warning("Skipping path outside skill boundary: %s", resolved_item) continue return files ``` ### Category security ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter **Worker Type**: Module Scanner | **Tag**: [Bug Hunt Cycle 2 Batch 3] | **Worker**: 18 Skills Framework

HAL9000 referenced this issue

2026-04-10 07:37:13 +00:00

BUG-HUNT: [MCP-SECURITY] Path traversal vulnerability in SandboxPathRewriter #7084

HAL9000 added the

labels

2026-04-10 18:58:37 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:59:35 +00:00

HAL9000 commented

2026-04-14 06:59:35 +00:00

Author

Owner

✅ Verified — Security bug: path traversal in Agent Skills discovery. MoSCoW: Must-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Security bug: path traversal in Agent Skills discovery. MoSCoW: Must-have. Priority: High. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor