T09 · Insecure Skill Coding Practices
Warning
- Location
src/commands/merchant.ts:238- Finding
Documented confirmation gates are not enforced for destructive and customer-facing operations
- Content
View full analysis
') .description('删除商家') .action((id) => { try { const merchant = merchantDb.getMerchantById(parseInt(id)); if (!merchant) { console.log(chalk.red('❌ 商家不存在')); process.exit(1); } merchantDb.deleteMerchant(parseInt(id)); console.log(chalk.green(`✅ 商家 "${merchant.name}" 已删除`)); } catch (error) { console.error(chalk.red('❌ 删除失败:'), error instanceof Error ? error.message : error); process.exit(1); } }); ``` Product deletion is similarly immediate: ```ts // 删除商品 product .command('delete ') .description('删除商品') .action((id) => { try { const prod = productDb.getProductById(parseInt(id)); if (!prod) { console.log(chalk.red('❌ 商品不存在')); process.exit(1); } productDb.deleteProduct(parseInt(id)); console.log(chalk.green(`✅ 商品 "${prod.name}" 已删除`)); } catch (error) { console.error(chalk.red('❌ 删除失败:'), error instanceof Error ? error.message : error); process.exit(1); } }); ``` Delivery-time changes also execute without checking ...[truncated 2147 chars]- Remediation
View remediation
`. 5. Detect delivery-time reductions and require additional confirmation specifically for shortened promises. 6. Require a reason and optionally an effective time for rejection, suspension, deletion, and customer-facing changes. 7. Wrap multi-record operations in transactions. 8. Create a backup or soft-delete/audit-log record before irreversible deletion. 9. Include changed IDs, previous values, new values, and a rollback command in completion output. 10. Add automated tests proving that high-risk commands fail closed when confirmation is absent. ]]>