T09 · Insecure Skill Coding Practices
- Location
scripts/publish.js:114- Finding
Public Image Upload and Post Publication Lack an Enforced Confirmation Gate
- Content
View full analysis
Vulnerability Details
File Location:
scripts/publish.js, lines 114–170
Vulnerability Type: Unconfirmed public publication and data upload
Risk Level: MediumTechnical Analysis
The executable publication path does not require a confirmation flag, interactive prompt, dry-run approval, or confirmation artifact. Once invoked with a valid session and draft path, it uploads every local image referenced by the draft manifest and submits the resulting content as a public post.
Relevant code:
js // Deferred local-image upload: this is the ONLY moment the images // leave the user's machine (compose.js keeps everything local). try { content = await uploadLocalImages(content, htmlPath); } catch (err) { if (err instanceof SessionExpiredError) { console.error(`❌ ${err.message}`); process.exitCode = 2; return; } console.error(`\n❌ Image upload failed: ${err.message}`); console.error(' Nothing was posted. Fix the issue and re-run publish.js ' + '(already-uploaded images are reused, not re-uploaded).'); process.exitCode = 1; return; }js const postData = { type: 'text', content, ...(locInfo ? { lng: locInfo.lng, lat: locInfo.lat, locationName: locInfo.name, isLocationExposed: true, } : { isLocationExposed: false }), }; console.log('\nPublishing...'); try { const post = await publishWithRetry(postData);SKILL.mdlines 302–321 instruct the Agent to obtain explicit approval before publishing. However, this is only a documentary control.publish.jscan be called directly and contains no technical mechanism proving that the account owner approved the final draft, images, location, or account identity.The trust boundary is crossed when local files leave the machine and content is published under the authenticated user’s identity. Authentication and server-side moderation do not establish consent for a particular draft.
A further sequencing concern is ...[truncated 1494 chars]
- Remediation
View remediation
Remediation Suggestions
- Require a short-lived confirmation artifact before any upload or publication.
- Bind the artifact cryptographically or structurally to:
- The final draft hash.
- The manifest hash and exact image paths.
- The authenticated account ID.
- The selected location and exposure status.
- An expiration time and one-time nonce.
- Reject publication if the draft or manifest changes after approval.
- Validate the complete draft and manifest before uploading any image.
- Add a
--dry-runmode that performs all validation and displays the exact account, images, location, and content without network side effects. - For direct CLI use, require an interactive final prompt unless a valid confirmation artifact is supplied.
- Make image upload and post creation transactional where the platform supports it, or provide cleanup for uploads when post creation fails.