T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rcon.js:158- Finding
Destructive RCON Commands Execute Without Enforced Confirmation or Authorization
- Content
View full analysis
"'); console.log('Examples:'); console.log(' node rcon.js "list"'); console.log(' node rcon.js "ban PlayerX griefing"'); console.log(' node rcon.js "give Steve minecraft:diamond 64"'); console.log('\nEnvironment variables:'); console.log(' MC_RCON_HOST (default: localhost)'); console.log(' MC_RCON_PORT (default: 25575)'); console.log(' MC_RCON_PASSWORD (required)'); console.log('\nTesting current RCON connection...'); testConnection().then(r => { if (r.ok) { console.log(`OK connection healthy (latency ${r.latency}ms)`); console.log(` ${r.listOutput}`); } else { console.error(`Connection failed: ${r.error}`); process.exit(1); } }); return; } const command = args.join(' '); rconExec(command) .then(result => { console.log(result); process.exit(0); }) .catch(err => { console.error(err.message); process.exit(1); }); } ``` ### Technical Analysis The command-line interface concatenates all supplied arguments and passes the result directly to `rconExec`. There is no command allowlist, argument validation, caller authorization, destructive-command detection, or confirmation-token verification. This behavior contradicts the mandatory confirmation protocol documented in `SKILL.md:132-151`. The documentation requires confirmation for operations such as `ban`, `ban-ip`, `op`, `fill`, `kill @e`, `stop`, and `save-off`, but the executable implementation does not enforce that policy. The exported `rconExec` and `rconMulti` functions also expose un ...[truncated 1498 chars]- Remediation
View remediation