T09 · Insecure Skill Coding Practices
- Location
scripts/publish.js:68- Finding
Public post publication lacks an executable user-confirmation gate
- Content
View full analysis
Vulnerability Details
File Location:
scripts/publish.js:68-71, 99-108, 154-170
Vulnerability Type: Missing authorization confirmation for a public state-changing operation
Risk Level: MediumComplete Code Snippet
javascript async function publishWithRetry(postData, maxRetries = 3) { let lastError; for (let attempt = 1; attempt <= maxRetries; attempt++) { try { const body = await api('POST', '/api/posts', postData); if (body && body.success && body.post) return body.post; throw new Error(body && body.error ? body.error : 'Unexpected response');javascript async function main() { const [, , htmlPath] = process.argv; if (!htmlPath) { console.error('Usage: node publish.js <html-file-path>'); process.exit(1); } let content = fs.readFileSync(htmlPath, 'utf-8'); console.log(`Content length: ${content.length} chars`);javascript const postData = { type: 'text', content, ...(locInfo ? { lng: locInfo.lng, lat: locInfo.lat, locationName: locInfo.name, isLocationExposed: true, } : { isLocationExposed: false }), }; console.log('\nPublishing...'); try { const post = await publishWithRetry(postData);Technical Analysis
The publication script accepts only a draft path and immediately proceeds toward an authenticated
POST /api/posts. It does not require a confirmation flag, interactive approval, dry-run transition, or short-lived authorization artifact.SKILL.md:302-325instructs the agent to present a preview and wait for an explicit publish decision. That documentation is useful workflow guidance, but it is not enforced by the executable entry point. Any agent or other caller with access to the script can bypass the documented confirmation stage by invoking the script directly.Before posting, the same execution path can upload local images referenced by the draft. The resulting payload can also include a location with ...[truncated 1465 chars]
- Remediation
View remediation
Remediation Suggestions
- Make preview or dry-run behavior the default.
- Require an explicit
--confirm-publishcontrol before any upload or publication occurs. - Prefer a short-lived approval artifact generated after the user-facing preview step.
- Bind the approval artifact to:
- A cryptographic hash of the final draft.
- The authenticated account identifier.
- The image manifest.
- The location and exposure setting.
- An expiration time.
- Reject publication if the draft or account differs from the approved values.
- Perform the confirmation check before uploading local images, preventing disclosure when publication was not authorized.