T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/update.sh:12
- Finding
- Unconfirmed Destructive Repository Cleanup During Self-Update## Vulnerability Details **File Location**: `scripts/update.sh`, lines 12–15 **Vulnerability Type**: Destructive update operation without confirmation or dry-run protection **Risk Level**: Medium ### Complete Code Snippet ```bash cd "$(dirname "$0")/.." git reset --hard HEAD 2>/dev/null git clean -fd 2>/dev/null git pull 2>/dev/null ``` ### Technical Analysis The self-update script changes into the Skill repository and unconditionally performs two destructive Git operations before pulling updates: - `git reset --hard HEAD` discards modifications to tracked files in the index and working tree. - `git clean -fd` recursively deletes untracked files and directories. The script provides no confirmation prompt, explicit destructive-operation flag, dry-run mode, or backup mechanism. Redirecting standard error to `/dev/null` further obscures failures and makes it harder for the operator to understand which update step failed. This behavior conflicts with the preservation-oriented update procedure documented in `references/self-update-imagine.md:5`, which specifies: ```text cd {agent_root}/skills/ocas-imagine && git stash && git pull origin main && git stash pop ``` The executable implementation therefore expands a routine update operation into an irreversible local cleanup that is not disclosed by its usage message, which only states that it pulls the latest version while preserving local data. ### Attack Path 1. The update helper is invoked directly with `bash scripts/update.sh`, or through the self-update mechanism described by the Skill. 2. The script changes into the repository root. 3. `git reset --hard HEAD` silently removes tracked local modifications. 4. `git clean -fd` silently removes all untracked files and directories beneath that repository. 5. Only after this deletion does the script run `git pull`. 6. Any local customization or untracked data stored in the Skill repository is lost without an interactive approval step or recoverable backup. No ...[truncated 922 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional `git reset --hard` and `git clean -fd` operations from the normal update path. 2. Implement the documented preservation flow using `git stash`, an explicit upstream pull, and `git stash pop`, while handling merge conflicts safely. 3. If cleanup is genuinely required, place it behind an explicit option such as `--discard-local-changes`. 4. Before destructive cleanup: - Show the affected tracked and untracked files. - Require explicit user confirmation. - Support a dry-run mode. - Create a recoverable backup or archive. 5. Validate that the resolved repository directory is the intended Skill root before running Git commands. 6. Stop suppressing all Git errors. Return clear failures and abort immediately when a step fails. 7. Update the usage text and Skill documentation so the actual effects are accurately disclosed.