T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:198
- Finding
- Unsafe Recommendation to Disable Agent Confirmation and Permission Controls## Vulnerability Details **File Location**: `SKILL.md`, line 198 **Vulnerability Type**: Unsafe agent configuration guidance **Risk Level**: Medium ### Vulnerable Code ```markdown - `--no-ask-user` / `--allow-all` flags reduce confirmation round-trips ``` ### Technical Analysis The Skill recommends disabling interactive confirmation or broadly allowing agent operations as a token-efficiency measure. These controls are security boundaries intended to ensure that sensitive tool actions receive explicit authorization. Disabling them is unnecessary for the Skill's stated token-optimization purpose and conflicts with least-privilege operation. The recommendation has no accompanying restrictions requiring a disposable sandbox, read-only tools, a narrowly scoped command allowlist, or an environment without secrets and production access. Consequently, users may apply it to agents with shell, filesystem, network, deployment, or credential-bearing tools. This does not independently grant operating-system privileges beyond those already available to the agent. It does, however, remove a user-approval boundary and allows the agent to exercise its existing permissions without case-by-case confirmation. ### Attack Path 1. A user follows the Skill's advice and starts or configures an agent with `--no-ask-user` or `--allow-all`. 2. The agent has access to sensitive tools, such as shell execution, filesystem writes, network requests, deployment APIs, or credential-enabled integrations. 3. The agent processes attacker-controlled repository content, external data containing prompt injection, or an erroneous generated instruction. 4. That content induces the agent to request a destructive, privileged, or externally visible action. 5. Because the confirmation or permission boundary has been disabled, the action executes without explicit user review. 6. The action affects resources accessible under the agent process's existing identity. ### Impact Assessment An attacker or ...[truncated 753 chars]
- Remediation
- ## Remediation Suggestions Remove the unconditional recommendation to use `--no-ask-user` or `--allow-all`. Replace it with guidance that preserves explicit approval for sensitive operations while reducing unnecessary interaction safely: - Use least-privilege tool policies and grant only capabilities required for the current task. - Batch clearly defined, low-risk, read-only operations into one approval. - Use narrow command and path allowlists rather than unrestricted permission flags. - Require confirmation for shell execution, file writes, credential access, network requests, deployments, and destructive actions. - Run autonomous workflows in disposable sandboxes with no production credentials, sensitive mounts, or unrestricted network access. - Separate read-only analysis from mutation or deployment phases. - Log all autonomous tool calls and retain an emergency termination mechanism. - If non-interactive flags must be documented, include a prominent warning and restrict their use to isolated environments with explicitly bounded permissions. A safer replacement would be: ```markdown - Reduce confirmation round-trips by batching pre-approved, read-only operations. Preserve confirmation for writes, command execution, network access, credential use, and deployments. Avoid unrestricted flags such as `--allow-all` except in disposable sandboxes with no secrets or production access. ```