T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:49
- Finding
- Unsafe Development Workflow Encourages Bypassing Quality and Repository Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 49–51 **Vulnerability Type**: Unsafe operational guidance **Risk Level**: Medium **Complete Code Snippet**: ```text CATEGORY: Any% Bug Fix RULES: ├── Timer starts when you read the bug report ├── Timer stops when the fix is committed ├── No quality gates (tests optional, review optional) ├── Skips allowed (copy-paste from StackOverflow = valid strat) └── Glitches allowed (force push = frame-perfect skip) ``` ### Technical Analysis The skill explicitly presents skipping tests and review, copying unverified third-party code, and force-pushing as acceptable strategies. Although framed as speedrun terminology, an agent applying these instructions to a real repository could treat security and integrity controls as optional. Copying code from an untrusted source without verification can introduce vulnerabilities, malicious behavior, incompatible licensing, or defective logic. Skipping testing and review reduces the likelihood that such problems will be detected. Force-pushing can overwrite shared branch history, remove other contributors' changes, and bypass branch-management expectations where repository permissions permit it. These actions are unnecessary for the skill's timer and gamification functionality. The risk arises from unsafe workflow instructions rather than executable code. The audited project contains no scripts or implementation that automatically performs these operations. ### Attack Path 1. A user or agent invokes the skill for a coding task and selects the “Any%” category. 2. The agent follows the documented rule that tests and review are optional. 3. The agent copies an unverified implementation from a public source without performing provenance or security checks. 4. The unverified code is committed without adequate validation. 5. If the agent has remote repository credentials and force-push permission, it may force-push the change a ...[truncated 751 chars]
- Remediation
- ## Remediation Suggestions 1. Remove language that endorses force-pushing, unverified code reuse, and omission of essential quality controls. 2. Require tests appropriate to the change, even in time-focused categories. 3. Require explicit user confirmation before any destructive Git operation. 4. Prefer ordinary pushes and protected pull-request workflows. If force-pushing is genuinely necessary, use `--force-with-lease` only after verifying the remote branch state. 5. Require copied code to undergo provenance, license, compatibility, and security review before integration. 6. Redefine “Any%” as minimizing implementation time without bypassing mandatory security, review, or repository-integrity safeguards. 7. Add a clear rule stating that gamification never overrides organizational policies, branch protections, secure coding standards, or the agent's safety constraints.