T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:151
- Finding
- Transaction-capable workflows can be deployed and executed without a mandatory final approval gate<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:151-176` - `references/workflow-patterns.md:130-143` **Vulnerability Type**: Missing authorization boundary for financial and state-changing operations **Risk Level**: High ### Vulnerable Instructions `SKILL.md:151-176`: ```text Now give the K3 orchestrator everything it needs. Use `generateWorkflow()` with a detailed prompt that includes: - **Trigger type and schedule** (e.g., "runs daily" or "triggers on wallet activity") - **Data source and how to query it** (e.g., "use Read Graph to query pool X" or "use Read Smart Contract to get the pair's reserves") - **What the AI should analyze** (e.g., "highlight TVL changes over 5%") - **Any actions to take** (e.g., "execute a swap on Uniswap if condition is met") - **How to deliver results** (e.g., "send Telegram alert" or "email the report") - **Any MCP integration IDs** the orchestrator needs (from team integrations) Set `deployWorkflow: false` on the first call so you can review before deploying. The orchestrator will likely ask follow-up questions — answer them using `editGeneratedWorkflow()` with the same `generatedWorkflowId`. This back-and-forth is normal; expect 2-4 rounds. Once the configuration looks correct, call `editGeneratedWorkflow()` one final time with `deployWorkflow: true`. For the full list of available functions, triggers, AI models, and output options, read `references/node-types.md`. ## Step 4: Deploy and Verify After deploying: 1. **Run it manually** with `executeWorkflow()` to trigger an immediate test ``` `references/workflow-patterns.md:130-143`: ```text ## Pattern 7: Automated Trading / Action Analyzes data and then takes an on-chain action based on the analysis. [Scheduled / Event] → [Read data] → [AI Conditional] → [Uniswap / Token Transfer / Write Smart Contract] **When to use**: "Swap when price hits X", "Rebalance my portfolio weekly", "Auto-transfer tokens when conditions are met" **Example**: Sched ...[truncated 4007 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit approval before deployment** - Present the final generated workflow to the user. - Require an affirmative confirmation after displaying all state-changing nodes. - Treat edits after confirmation as invalidating the approval. 2. **Require a separate approval before first financial execution** - Do not automatically call `executeWorkflow()` on workflows containing swaps, transfers, approvals, exchange trades, or contract writes. - Require a second confirmation immediately before the first state-changing run. - Clearly state that the test can spend funds or alter on-chain state. 3. **Provide a complete transaction preview** - Display chain ID, wallet, recipient, contract, function, calldata summary, asset, maximum amount, allowance, slippage, fees, schedule, and trigger conditions. - Distinguish read-only nodes from state-changing nodes. 4. **Default to simulation** - Run read-only nodes and transaction simulations first. - Verify expected balance changes, contract calls, revert behavior, and estimated fees. - Do not interpret successful workflow deployment as proof that a transaction is safe. 5. **Enforce hard policy controls** - Apply maximum per-transaction and cumulative spending limits. - Use destination and contract allowlists. - Set bounded token allowances rather than unlimited approvals. - Enforce maximum slippage and fee limits. - Limit execution frequency and add cooldown periods. 6. **Avoid AI-only authorization** - Do not permit an AI Conditional node by itself to authorize a financial operation. - Use deterministic, validated conditions for execution. - Treat external API, scraped web content, MCP responses, and AI output as untrusted data. 7. **Add operational safeguards** - Start transaction-capable workflows in a paused state. - Provide an emergency pause mechanism. - Notify the user before and after every state-changing e ...[truncated 352 chars]