T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/ari.py:1173
- Finding
- Specialized Product-Upgrade Workflow Restrictions Can Be Bypassed## Vulnerability Details **File Location**: `scripts/ari.py`, lines 1173–1174 and 1654–1655 **Vulnerability Type**: Specialized workflow scope-validation bypass **Risk Level**: Medium The Skill declares a fixed `product/upgrade` operational contract in `skill-defaults.json` and `references/operation-workflow.md`. However, the CLI accepts user-controlled `--workflow` and `--focus` arguments and gives those arguments precedence over the fixed values. ### Vulnerable Code ```python def operation_payload(args): defaults = operation_defaults() workflow = (getattr(args, "workflow", None) or defaults.get("workflow") or "").strip() focus = (getattr(args, "focus", None) or defaults.get("focus") or "").strip() if not workflow or not focus: return None, error_obj( "ARI_VALIDATION_ERROR", 0, "运营工作流缺少 workflow/focus", "通用 Skill 请显式传 --workflow 和 --focus；专属 Skill 会内置固定值。") request_id = (getattr(args, "request_id", None) or "").strip() or str(uuid.uuid4()) return { "requestId": request_id, "workflow": workflow, "focus": focus, "asin": args.asin.upper(), "site": args.site or defaults.get("defaultSite") or "amz_us", "competitorAsin": (getattr(args, "competitor", None) or "").upper(), }, None ``` The parser explicitly exposes the override parameters: ```python def add_operation_args(parser, confirm=False): parser.add_argument("--asin", required=True) parser.add_argument("--site", default="amz_us", choices=SITES) parser.add_argument("--workflow") parser.add_argument("--focus") parser.add_argument("--competitor") parser.add_argument("--request-id", default="") if confirm: parser.add_argument("--confirm", action="store_true", help="确认按报价扣点并生成；未提供时只返回报价") ``` The intended fixed configuration is: ```json { "schemaVersion": 1, "channel": "product-upgrade", "workflow": "product", "focus": "upgrade", " ...[truncated 2910 chars]
- Remediation
- ## Remediation Suggestions 1. **Make specialized defaults authoritative.** If `skill-defaults.json` defines `workflow` and `focus`, use those values unconditionally: ```python defaults = operation_defaults() fixed_workflow = (defaults.get("workflow") or "").strip() fixed_focus = (defaults.get("focus") or "").strip() if fixed_workflow and fixed_focus: workflow = fixed_workflow focus = fixed_focus else: workflow = (getattr(args, "workflow", None) or "").strip() focus = (getattr(args, "focus", None) or "").strip() ``` 2. **Reject conflicting arguments instead of silently ignoring them.** If callers provide values different from the fixed configuration, return a validation error: ```python supplied_workflow = (getattr(args, "workflow", None) or "").strip() supplied_focus = (getattr(args, "focus", None) or "").strip() if fixed_workflow and supplied_workflow and supplied_workflow != fixed_workflow: return None, error_obj( "ARI_FIXED_WORKFLOW_VIOLATION", 0, "This specialized Skill only permits the configured workflow." ) if fixed_focus and supplied_focus and supplied_focus != fixed_focus: return None, error_obj( "ARI_FIXED_FOCUS_VIOLATION", 0, "This specialized Skill only permits the configured focus." ) ``` 3. **Remove `--workflow` and `--focus` from specialized builds.** Retain these options only in a separate generic CLI distribution where arbitrary supported combinations are intentionally allowed. 4. **Validate twice.** Verify the fixed workflow and focus both before requesting a quote and immediately before submitting a confirmed run. This prevents later refactoring from introducing a quote/run mismatch. 5. **Add server-side enforcement.** Include the Skill channel or variant identity in the authenticated request and have the server reject workflow/focus combinations that are not permitted for that channel. Client-side re ...[truncated 449 chars]