fix(security): heredoc-quote user task + mktemp for output#16
Open
sahrizvi wants to merge 1 commit into
Open
Conversation
The documented altimate-code invocation was:
altimate-code run "<user's task>" --yolo \
--output /tmp/altimate-result.md --dir "$(pwd)"
Two problems flagged on the altimate-codex-plugin PR review, which
apply to this SoT as well (same SKILL.md content is cloned into four
sibling plugins):
1. **Shell injection.** Substituting raw user text inside a
double-quoted shell argument leaves `$(...)` and backticks live.
A task like `refactor `whoami` and $(rm -rf ~)` gets
command-substituted by the shell before `altimate-code` ever runs,
and `--yolo` removes the confirmation gate. Fix: heredoc-quote the
task into a variable, then pass the variable in.
2. **Hardcoded shared output path.** `/tmp/altimate-result.md` is
world-readable, shared across concurrent sessions, and can hold
warehouse rows, lineage, or PII findings from a delegation. Fix:
`umask 077; OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"`,
reuse the variable, delete after reading.
Applied to both `skills/altimate-code/SKILL.md` (the delegation skill
body) and `skills/altimate-code/commands/altimate.md` (the `/altimate`
slash command).
Sibling plugins (altimate-claude-plugin, altimate-codex-plugin,
altimate-opencode-plugin) get the same fix in parallel PRs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The documented altimate-code invocation was:
Two security-adjacent issues surfaced during the altimate-codex-plugin PR review. This SoT ships the SKILL.md that gets cloned into four sibling plugins, so the canonical fix lives here.
1. Shell injection (HIGH)
Substituting raw user text inside
"..."leaves$(...)and backticks live. A task likerefactor `whoami` and $(rm -rf ~)gets command-substituted by the shell beforealtimate-codeever runs, and--yoloremoves the confirmation gate. Fix: here-doc the task into a variable, then pass the variable:2. Hardcoded shared output path (MAJOR)
/tmp/altimate-result.mdis world-readable, shared across concurrent sessions, and can hold warehouse rows, lineage, or PII findings. Fix:umask 077; OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)", reuse the variable, delete after reading.Files changed
skills/altimate-code/SKILL.md— delegation skill body (both first-invocation +--continuefollow-up blocks)skills/altimate-code/commands/altimate.md—/altimateslash commandBase branch
Cut off
feat/altimate-code-session-start-hookbecause the block structure I'm editing (thefast-edit/analyst/builderclassification +--continueguidance) doesn't exist onmainyet. Once that branch merges to main, this PR rides in cleanly.Same fix landing in parallel PRs on
altimate-claude-plugin,altimate-codex-plugin, andaltimate-opencode-plugin.