T09 · Insecure Skill Coding Practices
- Location
SKILL.md:10- Finding
Unbounded Autonomous Code-Modification and Recursion Workflow
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:10-40,SKILL.md:175-188, andreferences/workflows.md:24-53
Vulnerability Type: Uncontrolled autonomous modification workflow
Risk Level: MediumRelevant Skill Instructions
The following is a faithful English translation of the relevant instructions in
SKILL.md:10-40:text The system has two basic operating modes and switches between them automatically according to system state. Repair mode: 1. Identify the error, including its type, location, and impact. 2. Analyze the root cause. 3. Design a repair. 4. Change the code or logic. 5. Run unit tests. 6. Run integration tests. 7. If validation succeeds, mark the issue repaired; otherwise, return to step 1. Optimization mode: 1. Collect performance metrics. 2. Analyze code complexity. 3. Design a refactoring plan. 4. Create a migration plan. 5. Implement the plan incrementally. 6. Run regression tests. 7. Compare metrics. 8. If performance improves, mark the system optimized; otherwise, retain the original state.The following is a faithful English translation of
SKILL.md:175-188:text The system automatically manages versions. Version format: vN.M Upgrade conditions: - Complete N optimization rounds. - Accumulate at least 10 improvements. - Remain stable for 24 hours.The recursive behavior is specified in
references/workflows.md:51-53:text Phase 3: Recursive invocation Successful validation → recursively invoke the workflow and return to Phase 1.Technical Analysis
The Skill authorizes automatic mode selection, source-code or logic changes, incremental refactoring, version management, and recursive reinvocation. However, it does not define:
- Allowed repository paths or an explicit write scope.
- Protected files that the agent must not modify.
- Human approval before changes are written.
- A maximum numb ...[truncated 2845 chars]
- Remediation
View remediation
Remediation Suggestions
-
Require explicit scope
- Require the user to specify permitted files or directories.
- Deny writes outside that allowlist.
- Treat credentials, access-control code, CI/CD files, deployment definitions, dependency manifests, lockfiles, and security policies as protected unless separately authorized.
-
Add approval gates
- Generate a proposed patch before writing.
- Present the affected files, rationale, risk, and expected behavior.
- Require explicit user approval before applying each patch or logically grouped change set.
- Require separate approval for version changes.
-
Bound recursive execution
- Define a maximum number of repair and optimization rounds.
- Add wall-clock, command, token, and compute budgets.
- Stop after a configurable number of repeated validation failures.
- Require user confirmation before another round begins.
-
Constrain change size
- Limit the number of modified files and lines per round.
- Reject unexpected binary-file changes.
- Prevent generated files or vendored code from being modified unless explicitly included in scope.
-
Implement rollback safeguards
- Require a clean version-control state before execution.
- Create a checkpoint before each modification.
- Automatically restore the checkpoint if tests fail, metrics regress, or the execution budget is exceeded.
- Verify that rollback completed successfully.
-
Strengthen validation
- Run tests in an isolated environment with least privilege.
- Define objective acceptance criteria before changes begin.
- Require security tests for modifications affecting authentication, authorization, input handling, cryptography, dependencies, or deployment.
- Preserve logs and diffs for review.
-
Define deterministic termination
- End after one successful, user-approved repair by default.
- Permit o ...[truncated 146 chars]
-