T09 · Insecure Skill Coding Practices
Error
- Location
- references/requests.md:103
- Finding
- Undisclosed State-Changing and Destructive SchoolPass Operations## Vulnerability Details **File Location**: `references/requests.md:103-126` **Related Scope Declaration**: `SKILL.md:2, 9-15, 52-69` **Vulnerability Type**: Undisclosed write and delete operations without a confirmation gate **Risk Level**: High The skill is presented primarily as a read-only SchoolPass integration: ```markdown description: Read a SchoolPass parent account directly with curl against the regional SchoolPass REST API ``` However, the referenced request guide includes authenticated operations that create and delete student arrival or dismissal changes: ```bash ## Writes (verified live) Submit a dismissal/arrival change — `POST studentchange`. The body must match the app exactly: `dateSet.dates` EMPTY, `daysOfWeek` as NUMERIC ids (Monday=1…Sunday=7), `modifiedBy` = your parent member id (= `parentMemberId`), `changeType` from the E2 enum (Absent=1, LateArrival=2, EarlyDismissal=3, Carpool=4, Activity=5, Bus=6). ```bash STU=11278; DATE=2026-09-14; DOW=1 # DOW: Mon=1..Sun=7 for $DATE sp_curl POST "studentchange?schoolCode=${SCHOOLPASS_SCHOOL_CODE}&parentMemberId=${SP_MEMBER_ID}" "$(jq -nc \ --argjson sid "$STU" --arg date "$DATE" --argjson dow "$DOW" --argjson mid "$SP_MEMBER_ID" '{ studentId:$sid, moveToId:null, busStopId:null, dateSet:{dates:[], daysOfWeek:[$dow], startDate:$date, endDate:$date, recurringWeeks:0}, notes:"", pickupDropoffPerson:null, willReturn:false, timeOfDay:null, changeSeriesId:0, changeType:1, adType:3, userType:3, modifiedBy:$mid }')" # Verify: re-read the calendar; a non-default entry (isDefault:false, changeSeriesId set) appears. sp_curl GET "Student/StudentCalendar?schoolCode=${SCHOOLPASS_SCHOOL_CODE}&studentId=${STU}&startDate=${DATE}&endDate=${DATE}" | jq '.dailyList' ``` Cancel a change — `DELETE studentchange/DeleteMobileChange`, keyed on the `changeSeriesId` from the calendar: ```bash CSID=27074 # from the calendar entry's chang ...[truncated 2811 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all write and delete recipes from this read-oriented skill and place them in a separately named, explicitly read/write skill. 2. If mutation support is retained, update `SKILL.md` metadata, scope, and usage documentation to prominently disclose that the skill can modify and cancel student records. 3. Require explicit user confirmation immediately before every `POST` or `DELETE`, displaying the resolved student name, date, change type, destination, and existing record affected. 4. Resolve student and change-series identifiers through authenticated reads rather than accepting or demonstrating realistic hard-coded identifiers. 5. Validate that the selected student belongs to the authenticated parent account and that the target change exists before submitting a mutation. 6. Replace example identifiers with unmistakable placeholders such as `<STUDENT_ID>` and `<CHANGE_SERIES_ID>`. 7. Add a dry-run mode that prints the endpoint and normalized payload without sending the request. 8. After confirmation and execution, re-read the affected calendar record and clearly report the resulting server state. 9. Document rollback procedures and require separate confirmation before cancellation or deletion.