T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:33
- Finding
- Autonomous Dismissal of Security-Sensitive and System Dialogs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 33–37 **Vulnerability Type**: Unsafe autonomous user-interface interaction **Risk Level**: Medium ### Relevant Skill Instructions ```markdown ### Step 2: Periodic Inspection and Removal (Core Loop) Enter sleep mode. Wake up every five minutes and perform the following checks: 1. **Popup scan:** Check whether an interfering window is covering the target window, such as a system update notice, low-memory warning, antivirus advertisement, or software registration prompt. 2. **Removal:** If an unrelated popup is found, immediately identify its “X,” “Remind me later,” “Close,” or “Ignore” button and simulate a mouse click to dismiss it. 3. **Progress confirmation:** Check whether the target progress bar is advancing normally. If its percentage remains completely unchanged for three consecutive checks, consider the task stalled and proceed to Step 3. ``` The excerpt is an English translation of the relevant instructions in `SKILL.md`. ### Technical Analysis The Skill authorizes an agent to classify and dismiss dialogs solely through visual recognition. The listed targets include system-update notices, low-memory warnings, and antivirus dialogs. These classes can contain legitimate security, stability, data-loss, or authorization warnings rather than harmless advertisements. The instruction to click generic controls such as “Close,” “Ignore,” or “Remind me later” does not require an application allowlist, exact dialog identification, confidence threshold, or user confirmation. Visual similarity is therefore sufficient to trigger an autonomous click. The later prohibition against selecting restart or installation controls reduces some risk but does not prevent the agent from suppressing genuine warnings or interacting with a deceptive dialog. This is an insecure Skill design because the agent is given broad control over the active desktop without adequate validation of the window owner, dia ...[truncated 1682 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict automatic dismissal to an explicit allowlist of application names, window owners, dialog titles, and known button labels. 2. Never automatically dismiss operating-system, antivirus, firewall, update, permission, authentication, storage, memory, crash, or data-loss warnings. 3. Require user confirmation for any dialog that is ambiguous, security-sensitive, system-owned, or absent from the allowlist. 4. Verify the foreground window’s owning process and ensure it belongs to the monitored application before clicking. 5. Use a high-confidence threshold and default to notification-only behavior when classification is uncertain. 6. Prefer non-destructive actions, such as sending an alert and leaving the dialog untouched. 7. Record the window title, owning application, classification result, and proposed action before interaction to support later review. 8. Add explicit safeguards against dialogs designed to mimic trusted controls or reposition buttons beneath the pointer. 9. Limit automated interaction to the monitored application’s window bounds and prohibit clicks on unrelated desktop or system UI. 10. Provide a configurable dry-run mode that reports detected dialogs without clicking them. ]]>