T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:95
- Finding
- Destructive and Mass-Messaging Operations Lack an Enforced Confirmation Gate## Vulnerability Details **File Location**: `SKILL.md:95-98`; related executable instructions in `references/endpoints.md:146-157, 297-320` **Vulnerability Type**: Authenticated state-changing operations without mandatory confirmation **Risk Level**: High ### Vulnerable Snippets `SKILL.md:95-98`: ```markdown - **Writes here really mutate Evite** — RSVPs, cancellations, broadcast emails to real guests. There's no MCP-side confirm-gate in this skill: you are the confirm gate. Test broadcasts/sends only against a throwaway event with a blackholed `@example.com` guest. ``` `references/endpoints.md:146-157`: ```sh ### 8. Broadcast to RSVP segments — `POST /tsunami/v1/services/event/{id}/broadcast/` CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR") curl -sS -b "$JAR" -c "$JAR" -X POST \ -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" \ -d '{"message":"Reminder: parking is on the north side!","captcha":null,"virtual_groups":["yes","maybe"],"participantCount":12}' \ "https://www.evite.com/tsunami/v1/services/event/$EVENT_ID/broadcast/" ``` `references/endpoints.md:297-320`: ```sh ### 15. Send the invitation ("Send now", assumed body) — `POST /services/event/v1/{id}/send/` CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR") curl -sS -b "$JAR" -c "$JAR" -X POST \ -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" -d '{}' \ "https://www.evite.com/services/event/v1/$EVENT_ID/send/" ``` ```sh ### 16. Cancel an event (also "delete draft") — `POST /services/event/v1/{id}/actions/cancel/` CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR") curl -sS -b "$JAR" -c "$JAR" -X POST \ -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" -d '{}' \ "https://www.evite.com/services/event/v1/$EVENT_ID/actions/cancel/" \ -w '\n%{http_code}\n' ``` ### Technical Analysis The Skill supplies directly executable `curl` recip ...[truncated 2469 chars]
- Remediation
- ## Remediation Suggestions Replace direct write recipes with a controlled helper that enforces authorization at runtime: 1. Default every state-changing operation to dry-run or preview mode. 2. Resolve and display the event title, event ID, operation, message, recipient segments, and recipient count before execution. 3. Require a fresh explicit confirmation containing a one-time token bound to the previewed action. 4. Reject execution when the token does not match the exact event, operation, payload, and recipient set. 5. Require separate confirmation for high-impact operations such as broadcasts, invitation sends, guest removal, and cancellation. 6. Add configurable recipient limits and require elevated confirmation when a mass-message operation exceeds the limit. 7. Re-fetch relevant event state immediately before execution to detect stale identifiers or changed recipient lists. 8. Return and verify the HTTP status and response body, and provide an auditable summary of the completed action. 9. Keep read-only operations separate from write operations so ordinary inspection requests cannot accidentally reach mutating commands.