T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/example.py:42
- Finding
- Destructive Agent Deletion Bypasses the Required Confirmation## Vulnerability Details **File Location**: `scripts/example.py`, lines 42–43 and 65–66 **Vulnerability Type**: Missing authorization-style confirmation for a destructive operation **Risk Level**: Medium ### Vulnerable Code ```python p_delete = sub.add_parser("delete") p_delete.add_argument("name") ``` ```python elif args.action == "delete": result = run(["openclaw", "agents", "delete", args.name]) ``` The required safety policy appears in `SKILL.md`, lines 40–42 and 55: ```markdown - Delete: - Require explicit confirmation in the same turn for destructive action. - Then run: `openclaw agents delete <name>` ``` ```markdown - Treat `agent delete` as destructive: confirm before running. ``` ### Technical Analysis The Skill documentation explicitly requires same-turn confirmation before deleting an agent. However, the deterministic helper accepts only the agent name for its `delete` subcommand and immediately invokes `openclaw agents delete`. It has no confirmation option, matching-token check, or interactive confirmation mechanism. Consequently, the documented safeguard is enforced only through natural-language instructions and can be bypassed whenever the helper is invoked directly or mistakenly called without prior user confirmation. Although `subprocess.run` receives an argument array and does not introduce shell-command injection here, safe process invocation does not prevent unauthorized or accidental execution of the destructive operation. ### Attack Path 1. An attacker, automation error, or misunderstood request causes the helper to be invoked as `scripts/example.py delete <agent-name>`. 2. The argument parser accepts the target name without requesting confirmation. 3. The delete branch constructs `["openclaw", "agents", "delete", args.name]`. 4. The helper immediately executes that command. 5. If the caller has sufficient local OpenClaw permissions, the selected agent is d ...[truncated 743 chars]
- Remediation
- ## Remediation Suggestions Enforce confirmation inside the executable helper rather than relying solely on Skill instructions: 1. Add an explicit confirmation argument, such as `--confirm-delete <agent-name>`. 2. Require the confirmation value to exactly match the deletion target. 3. Refuse execution with a nonzero exit status when confirmation is absent or mismatched. 4. Ensure the calling agent obtains explicit confirmation from the user in the same turn before supplying the flag. 5. Where appropriate, first verify that the target exists and display the exact target to be deleted. 6. Add automated tests proving that unconfirmed and mismatched deletion requests cannot invoke `openclaw`. Example hardening pattern: ```python p_delete = sub.add_parser("delete") p_delete.add_argument("name") p_delete.add_argument("--confirm-delete", required=True) # ... elif args.action == "delete": if args.confirm_delete != args.name: parser.error("Deletion confirmation must exactly match the agent name") result = run(["openclaw", "agents", "delete", args.name]) ```