T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:154- Finding
Asynchronous Transfer Workflow Bypasses the Mandatory Approval Gate
- Content
View full analysis
\ --to-iban \ --to-name "" \ --amount \ --reason "" ``` Expected: - `Pending ID: ` Continue/poll: ```bash fints-agent-cli transfer-status --id --wait ``` ``` ### Technical Analysis The asynchronous workflow labels direct execution of `transfer-submit` as a “Safe submit flow,” but it does not instruct the agent to: 1. Perform a dry run or equivalent preflight. 2. Display and validate all transfer fields. 3. Obtain the exact final confirmation phrase `APPROVE TRANSFER`. 4. Verify that no transfer field changed after approval. This conflicts with the mandatory transfer gate defined earlier in `SKILL.md`, which requires those controls before executing a real transfer. Because `transfer-submit` submits the transaction and returns a pending identifier, approval deferred until status polling would occur too late. The synchronous workflow correctly separates dry-run and execution, while the asynchronous workflow provides only the real submission command. An agent following the workflow-specific instructions could therefore interpret them as an authorized exception to the general gate. ### Attack Path 1. A transfer is prepared using the asynchronous workflow. 2. The agent follows the documented “Safe submit flow.” 3. The agent invokes `fints-agent-cli transfer-submit` without first running a preflight or obtaining `APPROVE TRANSFER`. 4. The CLI sends the transfer request to the configured bank. 5. The bank may authorize, queue, or complete the transfer through its FinTS and TAN/SCA process. 6. Subsequent `transfer-status` calls only inspect or continue a transfer that has alrea ...[truncated 646 chars]- Remediation
View remediation