T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/budget.py:261
- Finding
- Unvalidated Numeric Inputs Permit Budget Enforcement Bypass<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/budget.py:43-63` - `scripts/budget.py:78-81` - `scripts/budget.py:261-276` - `scripts/budget.py:299-304` - `lib/pricing.py:47-67` - `lib/tracker.py:17-33` - `lib/alerts.py:27-45` **Vulnerability Type**: Improper numeric input validation and business-logic bypass **Risk Level**: Medium ### Vulnerable Code ```python # scripts/budget.py:43-63 if args.daily is not None: config.set_global_limit("daily", args.daily) print(f"✅ Set global daily limit: ${args.daily:.2f}") if args.weekly is not None: config.set_global_limit("weekly", args.weekly) print(f"✅ Set global weekly limit: ${args.weekly:.2f}") if args.monthly is not None: config.set_global_limit("monthly", args.monthly) print(f"✅ Set global monthly limit: ${args.monthly:.2f}") ``` ```python # scripts/budget.py:78-81 cost = pricing.get_cost(args.model, args.input_tokens, args.output_tokens) # Log usage tracker.log_usage( args.agent, args.model, args.input_tokens, args.output_tokens, cost ) ``` ```python # scripts/budget.py:261-276 set_parser.add_argument('--daily', type=float, help='Daily limit (USD)') set_parser.add_argument('--weekly', type=float, help='Weekly limit (USD)') set_parser.add_argument('--monthly', type=float, help='Monthly limit (USD)') log_parser.add_argument('--agent', required=True, help='Agent name') log_parser.add_argument('--model', required=True, help='Model name') log_parser.add_argument( '--input-tokens', type=int, required=True, help='Input tokens' ) log_parser.add_argument( '--output-tokens', type=int, required=True, help='Output tokens' ) ``` ```python # scripts/budget.py:299-304 pricing_parser.add_argument('--update', action='store_true', help='Update model pricing') pricing_parser.add_argument('--model', help='Model name') pricing_parser.add_argument('--input-price', type=float, help='I ...[truncated 4440 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require all budget limits and model prices to be finite and strictly greater than zero: ```python import math def validate_positive_finite(value: float, field: str) -> float: if not math.isfinite(value) or value <= 0: raise ValueError(f"{field} must be finite and greater than zero") return value ``` 2. Require token counts to be non-negative integers: ```python def validate_token_count(value: int, field: str) -> int: if isinstance(value, bool) or not isinstance(value, int) or value < 0: raise ValueError(f"{field} must be a non-negative integer") return value ``` 3. Apply validation inside `BudgetConfig.set_global_limit()`, `BudgetConfig.set_agent_limit()`, `PricingTable.update_model()`, `PricingTable.get_cost()`, and `UsageTracker.log_usage()`. Library-level validation is necessary because these classes may be called without the CLI. 4. Verify that every calculated and supplied cost is finite and non-negative before persisting it. 5. Treat malformed or non-finite values in existing configuration and ledger records as errors rather than silently using them in calculations. Consider failing closed for budget checks when accounting data cannot be validated. 6. Serialize standards-compliant JSON by using `json.dump(..., allow_nan=False)` and `json.dumps(..., allow_nan=False)`. 7. Add regression tests covering negative token counts, negative limits and prices, zero or non-finite limits, `NaN`, positive and negative infinity, malformed ledger records, and direct library invocation. ]]>