T09 · Insecure Skill Coding Practices
Note
- Location
- index.js:104
- Finding
- Undefined Variable Causes Task Operations to Fail<![CDATA[ ## Vulnerability Details **File Location**: `index.js`, lines 104–114 **Vulnerability Type**: Undefined variable resulting in application-level denial of service **Risk Level**: Low ### Vulnerable Code ```js addTask(message) { const tasks = loadData('tasks'); const taskText = message.replace(/添加任务/i, '').replace(/完成/i, '').trim(); if (!taskText) { return { message: '请输入任务内容，例如：添加任务 完成项目设计' }; } const task = { id: Date.now(), text: taskText, completed: lowerMessage.includes('完成'), created: new Date().toISOString() }; ``` ### Technical Analysis The `addTask()` function references `lowerMessage`, but that variable is neither declared within the function nor passed to it as an argument. It is declared locally inside `handle()` and therefore is not visible within `addTask()`. When execution reaches line 112, JavaScript throws a `ReferenceError`. Both task-addition branches in `handle()` invoke this vulnerable function, so an ordinary user message matching either supported task command can reliably cause the operation to fail. This is an insecure coding practice affecting availability and functional integrity. It does not provide command execution, data disclosure, privilege escalation, or unauthorized filesystem access. ### Attack Path 1. A user submits a message containing a supported task keyword, such as an add-task or completion command. 2. `handle()` identifies the keyword and calls `this.addTask(message)`. 3. `addTask()` parses the task text and constructs a new task object. 4. Line 112 evaluates `lowerMessage.includes(...)`. 5. Because `lowerMessage` is undefined in this scope, JavaScript throws a `ReferenceError`. 6. The task is not saved. If the host does not catch the exception, the entire request fails. ### Impact Assessment An unauthenticated caller who can submit normal Skill messages can repeatedly trigger failure of the task-addition workflow. The impact is limited to availability and reliability ...[truncated 258 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Normalize the message within `addTask()` or explicitly pass the normalized value from `handle()`. For example: ```js addTask(message) { const lowerMessage = message.toLowerCase(); const tasks = loadData('tasks'); const taskText = message.replace(/添加任务/i, '').replace(/完成/i, '').trim(); if (!taskText) { return { message: 'Please provide task content.' }; } const task = { id: Date.now(), text: taskText, completed: lowerMessage.includes('完成'), created: new Date().toISOString() }; tasks.push(task); saveData('tasks', tasks); return { success: true, message: `Task added: ${taskText}` }; } ``` Additionally: 1. Add automated tests for both add-task and completion-command inputs. 2. Add top-level error handling around Skill dispatch so unexpected exceptions produce a controlled error response. 3. Enable a linter rule such as ESLint `no-undef` to detect references to undeclared variables before release. 4. Validate that data is written only after the task object has been constructed successfully. ]]>