T09 · Insecure Skill Coding Practices
- Location
scripts/manage_profiles.py:401- Finding
Single-record deletion does not enforce user confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/manage_profiles.py, lines 401-402 and 507-516
Vulnerability Type: Missing authorization confirmation for a destructive operation
Risk Level: MediumVulnerable Code
python delete_review = subparsers.add_parser("delete-review", help="删除单次批改摘要") delete_review.add_argument("--review-id", required=True, help="要删除的批改编号")python if args.command == "delete-review": profile = read_profile(store_dir) if profile is None: fail("成长档案不存在") if args.review_id not in {item["review_id"] for item in profile["records"]}: fail("指定的 review_id 不存在") records = [item for item in profile["records"] if item["review_id"] != args.review_id] updated = rebuild_profile(profile, records, today) atomic_write_json(profile_path, updated) print_json({"growth_profile": updated}) returnTechnical Analysis
The Skill requires confirmation before deleting profile data. In particular,
references/profile-schema.mdstates that the Skill must ask the parent for confirmation before deleting an individual review.However, the executable CLI only requires a review identifier. Unlike profile deletion, insertion, update, and import operations, the
delete-reviewcommand has no mandatory confirmation flag and performs no runtime confirmation check.A documentation-level instruction does not enforce authorization when an Agent, automation layer, or another caller can invoke the script directly. Possession of an exact review ID verifies only which record is targeted; it does not prove that the parent authorized deletion.
Attack Path
- A growth profile has already been enabled and contains one or more review records.
- An Agent or automation component obtains or already knows a valid review ID.
- The caller invokes:
bash python3 scripts/manage_profiles.py \ --store-dir STORE_DIR \ del
...[truncated 1158 chars]
- Remediation
View remediation
Remediation Suggestions
-
Add a mandatory confirmation option to the
delete-reviewparser:python delete_review.add_argument( "--confirm-delete", action="store_true", help="Confirm deletion of the selected review", ) -
Enforce the option in the command handler before reading or modifying the profile:
python if args.command == "delete-review": if not args.confirm_delete: fail("Deleting a review requires --confirm-delete") -
Require the Agent to display the exact review ID and a summary of the record to the parent before invoking the command with the confirmation flag.
-
Update
references/profile-schema.mdso its CLI example and confirmation table explicitly require:bash delete-review --review-id ID --confirm-delete -
Add negative tests confirming that deletion without the flag fails and leaves
growth-profile.jsonunchanged. -
Consider retaining a user-controlled backup or implementing an explicitly authorized soft-delete mechanism if record recovery is a product requirement.
-