T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ari.py:1140
- Finding
- Remote Quote Response Can Bypass Explicit Confirmation for Paid Analysis<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ari.py`, lines 1140-1167 **Vulnerability Type**: Server-controlled authorization bypass for paid operations **Risk Level**: Medium ### Vulnerable Code ```python quote = request_json("POST", "/api/v1/analysis/quote", q_payload) if not ok(quote): return quote q_data = data_of(quote) or {} auto_confirmed = False if not confirm and q_data.get("autoConfirm") and q_data.get("sufficient"): confirm = True auto_confirmed = True ``` The resulting locally modified confirmation value controls whether the paid request is submitted: ```python payload = {"asin": (asin or "").upper(), "site": site, "outputLanguage": language} if kind == "compare": payload.update({"competitorAsin": (competitor or "").upper(), "competitorSite": competitor_site or site}) path = "/api/v1/analysis/" + kind if kind in SSE_TYPES: out = backfill_report_id(request_sse(path, payload), asin) else: out = request_json("POST", path, payload) ``` An equivalent server-controlled automatic-confirmation mechanism is also present in the combined VOC workflow around `scripts/ari.py:1353-1358`. ### Technical Analysis The CLI presents `--confirm` as the local authorization boundary for paid analysis. However, `run_analysis()` allows fields returned by the remote quote endpoint to change the local `confirm` variable from false to true. Consequently, a command invoked without `--confirm` can proceed beyond the quotation stage and submit a paid analysis request when the server returns both: - `autoConfirm` with a truthy value; and - `sufficient` with a truthy value. Consent for a paid operation should not be inferred solely from mutable remote response data. The response is received from an HTTPS endpoint restricted to the official origin, which mitigates ordinary redirection and network interception attacks. Nevertheless, a service defect, compromised service, incorrect account policy, or unexpected s ...[truncated 1661 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Preserve `--confirm` as an immutable local authorization decision. Never assign `confirm = True` based on fields from a server response. 2. When `--confirm` is absent, always return the quote and terminate before calling any paid analysis endpoint. 3. Remove the equivalent automatic-confirmation path from the combined VOC workflow at `scripts/ari.py:1353-1358`. 4. If automatic confirmation remains a supported feature, require a separate explicit local opt-in stored in protected local configuration. The setting should include: - A clearly defined maximum charge per operation. - An optional cumulative daily or monthly limit. - The permitted operation types. - A straightforward command to disable the feature. 5. Treat server-provided `autoConfirm` fields only as informational account-policy metadata, not as proof of user consent. 6. Add regression tests verifying that every paid endpoint remains unreachable without `--confirm`, regardless of quote-response fields. 7. Update the CLI documentation so its confirmation guarantees accurately reflect implemented behavior. ]]>