fix(plugins): harden skill copy — no symlink-deref, scrub template PAT (#32 security) #149

2026-06-17T19:32:22Z

core-devops commented

2026-06-17 19:32:22 +00:00

Adversarial review of the #32 chain found 2 leak-hardening gaps in AgentskillsAdaptor: (1) copytree symlinks=False derefs a malicious skill-tree symlink into agent-readable /configs/skills (arbitrary-file-read) → symlinks=True; (2) _SCRUB_KEYS omitted MOLECULE_TEMPLATE_REPO_TOKEN/MOLECULE_ADMIN_TOKEN → plugin setup.sh could exfil the PAT → added. Both bounded today (our own repos) but load-bearing for #31 marketplace. Tests added. 🤖

core-devops added 1 commit 2026-06-17 19:32:22 +00:00

fix(plugins): harden skill copy — no symlink-deref, scrub template PAT (#32 security)

Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s

Details

ci / lint (pull_request) Successful in 23s

Details

ci / build (pull_request) Successful in 35s

Details

ci / smoke-install (pull_request) Successful in 1m8s

Details

ci / unit-tests (pull_request) Successful in 1m18s

Details

ci / responsiveness-e2e (pull_request) Successful in 1m51s

Details

f74d0849d0

Adversarial review of the #32 chain found two leak-hardening gaps in the
AgentskillsAdaptor install path (both bounded today since skills come from our
own private repos, but load-bearing once #31 admits third-party skills):

1. shutil.copytree defaulted to symlinks=False → a skill tree carrying a
   symlink (e.g. leak -> /etc/molecule.env or /proc/self/environ) would be
   DEREFERENCED and the target's contents copied into the agent-readable
   /configs/skills/ — an arbitrary-file-read into agent space. Fix: symlinks=True
   on both copytree calls (copy links as links, never deref) + skip symlinks in
   files_written.

2. _SCRUB_KEYS (the setup.sh env scrubber) omitted MOLECULE_TEMPLATE_REPO_TOKEN
   and MOLECULE_ADMIN_TOKEN, which ARE present in the workspace container env →
   a malicious plugin's setup.sh could inherit + exfiltrate the read-only
   template PAT. Fix: add both to the scrub set. (Closes the third-party-plugin
   vector; the agent-itself env-read is inherent to the interim single-token
   model, retired by the #31 marketplace broker.)

Tests: symlink-target-not-leaked + scrub-keys-present. Full registry suite green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-17 19:33:31 +00:00

molecule-code-reviewer left a comment

Security hardening: copytree symlinks=True (no deref into agent-readable /configs/skills) + scrub template/admin tokens from plugin setup.sh env. Tests added. APPROVE.

core-security approved these changes 2026-06-17 19:33:31 +00:00

core-security left a comment

Security hardening: copytree symlinks=True (no deref into agent-readable /configs/skills) + scrub template/admin tokens from plugin setup.sh env. Tests added. APPROVE.

core-devops merged commit 508572fb96 into main

2026-06-17 19:34:32 +00:00

core-devops deleted branch fix/rfc2843-32-copytree-symlink-scrub

2026-06-17 19:34:33 +00:00

core-devops referenced this pull request

2026-06-20 00:00:12 +00:00

fix(concierge): recognize plugin-delivered management MCP in RCA#2970 online gate #156

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ai-workspace-runtime#149