Either use WP's `wp_tempnam()` or use 'php://temp'.

Example: https://github.com/wp-cli/wp-cli/commit/a464817eb27c9c44aa20b92a56f0fb0235187edf#L1R41