T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:21
- Finding
- Unconditional Instructions to Delete Existing Implementation Code## Vulnerability Details **File Location**: `SKILL.md`, lines 21-28 **Vulnerability Type**: Destructive file-operation instructions without authorization safeguards **Risk Level**: Medium ### Vulnerable Instruction Snippet ```text Wrote the code before writing the test? Delete it. Start over. No exceptions: - Do not keep it as a reference - Do not adapt it while writing the test - Do not look at it - Deletion means deletion ``` The instruction is reinforced at lines 160-166: ```text All of these mean: delete the code. Start over using TDD. ``` ### Technical Analysis The skill directs an AI agent to delete implementation code whenever it determines that the code was written before a failing test. This is an unconditional destructive instruction. It does not require the agent to: - Obtain explicit user authorization before deletion. - Confirm that the affected code was created during the current task. - Distinguish disposable generated code from pre-existing user code. - Check whether the repository is under version control. - Create a backup, commit, patch, or temporary branch. - Present the proposed deletion scope for review. - Prefer non-destructive alternatives such as characterization tests. If the skill is loaded by an agent with filesystem write permissions, the instruction could cause deletion of valuable source code beyond what is legitimately necessary to promote test-driven development. The skill does not itself elevate privileges, but it encourages use of already available filesystem privileges without adequate authorization controls. ### Attack Path 1. A user invokes the skill while working in a writable source repository. 2. The agent identifies implementation code that was created before its corresponding test or concludes that the required TDD sequence was not followed. 3. The skill instructs the agent that there are no exceptions and that the implementation must be deleted. 4 ...[truncated 1016 chars]
- Remediation
- ## Remediation Suggestions Replace the unconditional deletion mandate with a non-destructive, approval-based workflow: 1. Never delete pre-existing or user-authored code solely because it was not developed test-first. 2. Add characterization tests around existing behavior before modifying the implementation. 3. Require explicit user confirmation before deleting or replacing any existing code. 4. Show the exact files and line ranges proposed for removal before performing the operation. 5. Verify that changes are recoverable through version control, a backup, or a saved patch. 6. Perform experimental rewrites on a temporary branch or in a separate worktree. 7. Limit automatic cleanup to code generated by the agent during the current task and not yet accepted by the user. 8. Prefer reverting the agent's own recent edits over deleting files or unrelated code. A safer replacement instruction would be: ```text If implementation already exists, do not delete it automatically. Preserve it, add characterization tests, and apply TDD to subsequent changes. Before removing or replacing existing code, show the proposed changes and obtain explicit user approval. Ensure that the original code is recoverable through version control or a backup. ```