T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pet-command.py:39- Finding
Ambiguous or Negated Natural-Language Requests Can Trigger Blockchain Transactions
- Content
View full analysis
tuple[str, list[str]]: lowered = normalize(text) gotchi_id = extract_gotchi_id(text) if any(phrase in lowered for phrase in ("pet status", "status", "when can i pet", "when pet")): return "pet-status.sh", [] if "check cooldown" in lowered or "cooldown" in lowered: return "check-cooldown.sh", [gotchi_id] if gotchi_id else [] # Enforced behavior: any pet action is batch-only (pet-all.sh). if "pet" in lowered: return "pet-all.sh", [] ``` ```python def run_command(cmd: list[str], dry_run: bool) -> int: print(f"dispatch={' '.join(shlex.quote(part) for part in cmd)}") if dry_run: return 0 proc = subprocess.run(cmd, text=True, capture_output=True) if proc.stdout: print(proc.stdout, end="") if proc.stderr: print(proc.stderr, end="", file=sys.stderr) return proc.returncode ``` ### Technical Analysis The command classifier treats any otherwise-unmatched input containing the substring `pet` as an affirmative instruction to execute `pet-all.sh`. It does not recognize negation, uncertainty, quoting, discussion, or a requirement for explicit confirmation. Consequently, inputs such as the following are classified as transaction requests: - `Do not pet my gotchis` - `Never pet them automatically` - `Can you explain what pet-all does?` - `I did not ask you to pet anything` Unless the dispatcher itself is invoked with `--dry-run` or `--tx-dry-run`, `run_command()` executes the selected script. The target script can submit a real transaction through the Bankr API. The use of an argument array in `subprocess.run()` prevents shell metacharacter injection, but it does not address the authorization flaw caused by overly broad intent classif ...[truncated 1041 chars]- Remediation
View remediation