T09 · Insecure Skill Coding Practices
- Location
scripts/aminer_client.py:904- Finding
High-Cost Scholar Profile Workflow Executes Without Mandatory Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/aminer_client.py:904-916, 937-940
Vulnerability Type: Missing cost-authorization enforcement
Risk Level: MediumVulnerable Code
python if args.dry_run: info = WORKFLOW_DRY_RUN_INFO.get(args.action, []) if not info: print(f"[Dry Run] No preview available for action '{args.action}'.") else: total = sum(p for _, p in info) print(f"[Dry Run] Action: {args.action}") for i, (api, price) in enumerate(info, 1): label = "Free" if price == 0 else f"¥{price:.2f}" print(f" {i}. {api} ({label})") print(f" Estimated total: ¥{total:.2f}") returnpython if args.action == "scholar_profile": if not args.name: parser.error("--action scholar_profile requires --name") result = workflow_scholar_profile(token, args.name)The required policy is documented in
SKILL.md:37-38:text High-Cost Confirmation (≥ ¥5): Before executing a workflow or call chain whose estimated total cost is ¥5.00 or more, stop and ask the user for confirmation first.Technical Analysis
The
scholar_profileworkflow has an estimated cost of approximately ¥6.00. Although the client supports an optional--dry-runmode that displays this estimate, it does not enforce confirmation before executing the workflow.When
--dry-runis omitted, control proceeds directly toworkflow_scholar_profile(). That workflow performs a free scholar search and then launches five paid APIs in parallel:person_detail: ¥1.00person_figure: ¥0.50person_paper_relation: ¥1.50person_patent_relation: ¥1.50person_project: ¥1.50
The executable behavior therefore contradicts the Skill's mandatory high-cost confirmation rule. Documentation and agent instructions are not sufficient security controls because the command-line client can be invoked directly or by automation.
Attack Path
- An attacker, automation pro ...[truncated 1048 chars]
- Remediation
View remediation
Remediation Suggestions
Enforce cost confirmation in executable code rather than relying on documentation or optional dry-run behavior.
- Calculate the maximum expected cost before dispatching any workflow.
- If the estimate is at least ¥5.00, reject execution unless the caller supplies an explicit confirmation flag such as
--confirm-cost. - Display the complete API chain and cost breakdown before exiting or requesting confirmation.
- Require the confirmation flag to be supplied separately from the action, making accidental invocation less likely.
- Apply the same centralized check to raw API calls and future workflows whose aggregate estimated cost reaches the threshold.
- Consider allowing users to select only required profile modules rather than always retrieving details, portrait, papers, patents, and projects.
- Add automated tests proving that
scholar_profilemakes no network request without confirmation.
Example enforcement:
python p.add_argument( "--confirm-cost", action="store_true", help="Explicitly authorize workflows estimated to cost ¥5.00 or more", ) planned = WORKFLOW_DRY_RUN_INFO.get(args.action, []) estimated_total = sum(price for _, price in planned) if estimated_total >= 5.00 and not args.confirm_cost: print(f"Estimated total: ¥{estimated_total:.2f}", file=sys.stderr) for api, price in planned: print(f" {api}: ¥{price:.2f}", file=sys.stderr) parser.error( "Explicit confirmation is required. Review the plan and rerun " "with --confirm-cost to authorize the charge." )