T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/aminer_client.py:904
- Finding
- High-Cost Scholar Profile Workflow Executes Without Mandatory Confirmation## Vulnerability Details **File Location**: `scripts/aminer_client.py:904-916, 937-940` **Vulnerability Type**: Missing cost-authorization enforcement **Risk Level**: Medium ### Vulnerable Code ```python if args.dry_run: info = WORKFLOW_DRY_RUN_INFO.get(args.action, []) if not info: print(f"[Dry Run] No preview available for action '{args.action}'.") else: total = sum(p for _, p in info) print(f"[Dry Run] Action: {args.action}") for i, (api, price) in enumerate(info, 1): label = "Free" if price == 0 else f"¥{price:.2f}" print(f" {i}. {api} ({label})") print(f" Estimated total: ¥{total:.2f}") return ``` ```python if args.action == "scholar_profile": if not args.name: parser.error("--action scholar_profile requires --name") result = workflow_scholar_profile(token, args.name) ``` The required policy is documented in `SKILL.md:37-38`: ```text High-Cost Confirmation (≥ ¥5): Before executing a workflow or call chain whose estimated total cost is ¥5.00 or more, stop and ask the user for confirmation first. ``` ### Technical Analysis The `scholar_profile` workflow has an estimated cost of approximately ¥6.00. Although the client supports an optional `--dry-run` mode that displays this estimate, it does not enforce confirmation before executing the workflow. When `--dry-run` is omitted, control proceeds directly to `workflow_scholar_profile()`. That workflow performs a free scholar search and then launches five paid APIs in parallel: - `person_detail`: ¥1.00 - `person_figure`: ¥0.50 - `person_paper_relation`: ¥1.50 - `person_patent_relation`: ¥1.50 - `person_project`: ¥1.50 The executable behavior therefore contradicts the Skill's mandatory high-cost confirmation rule. Documentation and agent instructions are not sufficient security controls because the command-line client can be invoked directly or by automation. ### Attack Path 1. An attacker, automation pro ...[truncated 1048 chars]
- Remediation
- ## Remediation Suggestions Enforce cost confirmation in executable code rather than relying on documentation or optional dry-run behavior. 1. Calculate the maximum expected cost before dispatching any workflow. 2. If the estimate is at least ¥5.00, reject execution unless the caller supplies an explicit confirmation flag such as `--confirm-cost`. 3. Display the complete API chain and cost breakdown before exiting or requesting confirmation. 4. Require the confirmation flag to be supplied separately from the action, making accidental invocation less likely. 5. Apply the same centralized check to raw API calls and future workflows whose aggregate estimated cost reaches the threshold. 6. Consider allowing users to select only required profile modules rather than always retrieving details, portrait, papers, patents, and projects. 7. Add automated tests proving that `scholar_profile` makes no network request without confirmation. Example enforcement: ```python p.add_argument( "--confirm-cost", action="store_true", help="Explicitly authorize workflows estimated to cost ¥5.00 or more", ) planned = WORKFLOW_DRY_RUN_INFO.get(args.action, []) estimated_total = sum(price for _, price in planned) if estimated_total >= 5.00 and not args.confirm_cost: print(f"Estimated total: ¥{estimated_total:.2f}", file=sys.stderr) for api, price in planned: print(f" {api}: ¥{price:.2f}", file=sys.stderr) parser.error( "Explicit confirmation is required. Review the plan and rerun " "with --confirm-cost to authorize the charge." ) ```