Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

QFinch assessment

Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. In the verified primary proof of concept, a malicious plugin sets plugin.json.commands to an external markdown file. A single apm install copies that outside file into .apm/prompts/ and then auto-integrates it into .github/prompts/secret.prompt.md in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact. Reviewed version and commit: - apm-cli version 0.8.11 - main commit 70b34faa16a5a783424698163deeb028854fd23a

Potential impact

This is a path traversal / arbitrary local file copy issue in the package install flow. Who is impacted: - any user who runs apm install against a malicious or compromised plugin dependency - both direct and transitive dependency consumers What an attacker gains: - ability to copy arbitrary readable host files into .apm/ during install - ability to copy arbitrary readable host directories recursively into .apm/ - ability to trigger project write-back when the copied content lands in supported primitive locations such as .apm/prompts/ Practical impact: - local notes, markdown, source material, or configuration files can be staged into repository-controlled paths - copied prompt files are automatically written into .github/prompts/, increasing the chance that sensitive or attacker-selected content is committed, synced, or consumed by other tooling - the issue breaks the expected trust boundary that a dependency install should copy only content belonging to the dependency itself

Technical context

Root cause: - src/apmcli/deps/pluginparser.py:336-348 - resolvesources() joins manifest-controlled agents, skills, commands, and directory-form hooks paths with pluginpath - it checks only exists() and issymlink() - it does not resolve the candidate and verify containment inside the plugin root - src/apmcli/deps/pluginparser.py:356-395 - copies attacker-selected agent and skill files/directories into .apm/ - src/apmcli/deps/pluginparser.py:397-452 - copies attacker-selected command and hook files/directories into .apm/ - src/apmcli/deps/pluginparser.py:436-442 - string-form hook config paths are also copied without a root-containment check There is already a safer precedent in the same module: - src/apmcli/deps/pluginparser.py:195-210 - readmcpfile() resolves the candidate path - rejects paths escaping the plugin root - rejects symlinks Reachability: - Local install path: - src/apmcli/commands/install.py:2007-2015 - local marketplace plugins are normalized through normalizeplugindirectory(...) - Remote install path: - src/apmcli/deps/githubdownloader.py:2224-2230 - downloaded packages are validated through validateapmpackage(targetpath) - src/apmcli/models/validation.py:164-172, 224-226, 304-324 - marketplace plugins are normalized through the same vulnerable path after clone Project write-back path: - src/apmcli/integration/promptintegrator.py:38-56 - reads .apm/prompts/.prompt.md - src/apmcli/integration/promptintegrator.py:170-189 - writes prompt files into .github/prompts/ - src/apmcli/commands/install.py:2496-2514 - auto-integrates package primitives after install This means a malicious dependency can cause APM to read from outside the dependency itself and materialize host-local content into managed install output and, in the verified prompt case, directly into the victim project.