T09 · Insecure Skill Coding Practices
- Location
scripts/create_ppt_task.py:76- Finding
Billed PPT Task Creation Lacks an Enforced Transaction Confirmation Gate
- Content
View full analysis
Vulnerability Details
File Location:
scripts/create_ppt_task.py:76-80, 108-124
Vulnerability Type: Unconfirmed billed operation
Risk Level: MediumTechnical Analysis
The task-creation API deducts billing when a PPT task is created, as documented in
api-reference.md:55-61. However, the executable entry point does not require a confirmation flag, approval artifact, dry-run step, or transaction-specific authorization before sending the billed request.The relevant code is:
python def api_create(params, token): for required in ("topic", "themeId", "outline"): if not params.get(required): return None, f"缺少必填参数: {required}", {} client = SkillHttpClient(auth_token=token, timeout=60) body = {k: params[k] for k in ("topic", "themeId", "outline")} for k in ("requirements", "material", "themeConfig", "illustrationMode", "generateType"): if k in params: body[k] = params[k] raw = client.post(f"{BASE_URL}/aippt/v1/skill/task/create", body) if not (raw.get("data") or {}).get("created"): return None, raw.get("rspDesc", "任务创建失败"), raw return (raw["data"] or {}).get("ppt_id", ""), "", rawpython # ── A: Create or retry ──────────────────────────────────────────────────── if state is None or state.get("status") == "CREATE_FAILED": if not params: print("ERROR: 缺少任务参数", flush=True); sys.exit(1) _log(wd, f"创建任务: {params.get('topic')!r}") try: ppt_id, err, raw = api_create(params, token) except SkillHttpError as e: save_state(wd, {"status": "CREATE_FAILED", "error": str(e)}) print("FAILED: 网络请求失败", flush=True) print(f"错误: {e}", flush=True); sys.exit(1)SKILL.mddirects the conversational workflow to display the outline and wait for user confirmation, but this requirement is not enforced by the script. A caller only needs valid parameters, a valid account token, and a work directory whose state is absent or marked `CREAT ...[truncated 1890 chars]- Remediation
View remediation
Remediation Suggestions
- Require an explicit confirmation parameter before any billed request, such as
--confirm-charge, and reject task creation when it is absent. - Bind confirmation to the exact transaction details, including a hash of the outline, theme, page count, account identity, and displayed cost estimate. Reject stale or mismatched approvals.
- Add a dry-run mode that validates parameters and displays the expected billing details without invoking the task-creation API.
- Distinguish network retry from billing retry. Do not automatically retry a potentially submitted request unless the service supports a caller-supplied idempotency key and the same key is reused.
- Record only a non-secret approval receipt in the work directory so polling can proceed without repeating confirmation or retaining unnecessary credential material.
- Keep the conversational confirmation in
SKILL.md, but treat it as user-interface guidance rather than a security control; enforce the authorization requirement inside the executable path.
- Require an explicit confirmation parameter before any billed request, such as