T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/caller.py:560
- Finding
- Cloud Script Deletion Is Performed Without an Enforced Confirmation Gate## Vulnerability Details **File Location**: `scripts/caller.py`, lines 560–578 **Vulnerability Type**: Unconfirmed destructive cloud operation **Risk Level**: Medium **Code Snippet**: ```python script_uuid = args.script_uuid or prompt_for_input("Script UUID", required=True) print("\n" + "=" * 60) print("Deleting script...") try: result = delete_script(script_uuid, ak, sk, security_token, region) if result.get("ok"): print("\n[OK] Script deleted successfully!") print(f" {result['text']}") else: print(f"\n[FAIL] Deletion failed: {result.get('error', {}).get('message')}") except Exception as e: print(f"\n[FAIL] Error occurred: {str(e)}") ``` ### Technical Analysis The `delete` command obtains a script UUID from a command-line argument or interactive prompt and immediately invokes `delete_script()`. It does not retrieve and display the target script's identity, request confirmation, require a confirmation flag bound to that UUID, or support a dry-run mode. Supplying the identifier is therefore treated as sufficient authorization for an irreversible cloud-account modification. The underlying `delete_script()` function also performs the API request directly, so there is no lower-level safeguard if the function is called outside the documented CLI workflow. ### Attack Path 1. The Skill runs with Huawei Cloud credentials that include `coc:script:delete`. 2. A caller, mistaken automation instruction, or manipulated Agent invocation selects the `delete` action and supplies a script UUID. 3. `do_delete_script()` accepts the UUID without a separate approval step. 4. The function invokes `delete_script()` using the authenticated user's credentials. 5. The corresponding Huawei Cloud COC script is deleted immediately. This path does not establish malicious intent by the project author. It is a reachable safety defect in a destructive cloud operation. ### Impact Assess ...[truncated 609 chars]
- Remediation
- ## Remediation Suggestions 1. Resolve the UUID to the script's name and metadata, display the exact target, and require an explicit interactive confirmation before deletion. 2. For automation, require a value-bound flag such as `--confirm-delete SC...` and reject the request unless it exactly matches `--script-uuid`. 3. Add a `--dry-run` mode that reports the selected account, region, UUID, and script name without issuing the deletion request. 4. Put the safeguard in the lowest practical shared layer so direct callers of `delete_script()` cannot accidentally bypass it, or expose a separately named low-level API and keep it out of normal Agent workflows. 5. Apply least-privilege IAM policies and omit `coc:script:delete` from credentials used only to create, inspect, or execute scripts. 6. Record non-secret deletion audit data, including the script UUID, region, timestamp, and requesting identity, while ensuring AK, SK, and security-token values are never logged.