T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/call.sh:104- Finding
Overly Broad UI Automation Can Confirm Unrelated System Dialogs
- Content
View full analysis
Vulnerability Details
File Location:
scripts/call.sh, lines 104–127
Vulnerability Type: Unsafe accessibility-based UI automation
Risk Level: MediumVulnerable Code
applescript set buttonNames to {"Call", "Anrufen", "Anruf", "Audio", "FaceTime Audio", "Fortfahren", "Continue", "OK", "Wählen", "Dial"} set candidateProcesses to {"Phone", "Telefon", "FaceTime", "CoreServicesUIAgent", "UserNotificationCenter"} repeat while ((current date) < deadline and clicked is false) delay 0.25 tell application "System Events" repeat with procName in candidateProcesses if exists process (procName as text) then tell process (procName as text) try repeat with win in windows if my clickMatchingButton(win, buttonNames) then set clicked to true exit repeat end if end repeat end try end tell end if if clicked then exit repeat end repeat end tell end repeatThe recursively invoked matching routine clicks any button whose accessibility name or description exactly matches one of the listed labels:
applescript repeat with btnName in buttonNames if n is (btnName as text) or d is (btnName as text) then click container return true end if end repeatTechnical Analysis
The script searches every window of several processes and clicks broadly named buttons such as
OK,Continue, andFortfahren. Its targets includeCoreServicesUIAgentandUserNotificationCenter, which can display dialogs unrelated to the telephone call.The script does not verify that a candidate window:
- Was created as a consequence of the current call request.
- Contains the normalized destination telephone number.
- Has call-specific text or accessibility identifiers.
- Belongs exclusively to Phone or FaceTime.
- Is the expected confirmation dialog rather than an unrelated notification or permission prompt ...[truncated 1759 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict automation to the specific Phone or FaceTime process expected for the selected URL scheme. Do not scan
CoreServicesUIAgentorUserNotificationCenterunless a tightly validated, unavoidable workflow requires it. - Remove generic labels such as
OK,Continue, andFortfahren. Match only call-specific controls such asCallorDial. - Validate the complete dialog context before clicking:
- Require call-specific window text.
- Require the normalized destination telephone number to appear.
- Check stable accessibility roles and identifiers.
- Confirm the expected application bundle identifier and frontmost window.
- Record the preexisting windows before opening the call URL and only inspect a newly created, expected dialog afterward.
- Prefer explicit user confirmation instead of automatic clicking where macOS does not provide a narrowly scoped calling API.
- Fail safely when no verified call dialog is found. Do not treat arbitrary matching UI as sufficient evidence that confirmation is appropriate.
- Add automated tests using mock accessibility trees containing unrelated
OKandContinuebuttons to ensure they are never clicked.
- Restrict automation to the specific Phone or FaceTime process expected for the selected URL scheme. Do not scan