T09 · Insecure Skill Coding Practices
- Location
scripts/store_traffic.py:291- Finding
Destructive API operations lack an enforced confirmation gate
- Content
View full analysis
Vulnerability Details
File Location:
scripts/store_traffic.py:291-302,scripts/store_traffic.py:467-477,scripts/store_traffic.py:888, andscripts/store_traffic.py:925
Vulnerability Type: Destructive remote operations without confirmation
Risk Level: MediumVulnerable Code
python def action_delete_store(args) -> None: session = load_session(args.session) require_step(session, "store", "No store to delete.") store_id = session["steps"]["store"]["data"]["id"] api_post("/rtc/store/delete", {"id": store_id}) session["steps"]["store"] = {"completed": False, "data": None} session["steps"]["device"] = {"completed": False, "data": None} session["steps"]["flowConfig"] = {"completed": False, "data": None} save_session(args.session, session) print(f"[ok] Store deleted: {store_id}")python def action_delete_device(args) -> None: session = load_session(args.session) require_step(session, "device", "No device to delete.") device_id = session["steps"]["device"]["data"]["id"] api_post("/rtc/device/delete", {"id": device_id}) session["steps"]["device"] = {"completed": False, "data": None} session["steps"]["flowConfig"] = {"completed": False, "data": None} save_session(args.session, session) print(f"[ok] Device deleted: {device_id}")python sub.add_parser("delete-store", help="Delete the current store")python sub.add_parser("delete-device", help="Delete the current device")Technical Analysis
The
delete-storeanddelete-devicehandlers immediately issue authenticated deletion requests after checking only whether the relevant resource exists in the local session. Therequire_step()checks are state checks, not confirmation or authorization gates.Neither command requires an interactive confirmation, a resource-bound confirmation value, nor an explicit force flag. The Skill documentation describes the deletion order but do ...[truncated 1753 chars]
- Remediation
View remediation
Remediation Suggestions
Require a fresh, explicit confirmation before each destructive request:
- Add a resource-bound argument such as
--confirm-delete STORE_IDor--confirm-delete DEVICE_ID. - Reject the operation when the supplied value does not exactly match the resource ID loaded from the session.
- Default to a dry-run or preview that displays the exact resource type, ID, and name without modifying remote state.
- Require the Agent to present this preview and obtain fresh user approval before invoking the confirmed operation.
- For interactive use, add a confirmation prompt, while retaining a non-interactive confirmation token for automation.
- Consider requiring an additional explicit flag, such as
--force, for store deletion because it also clears dependent device and flow-configuration state from the local session. - Record the confirmed target and operation in an audit log without including API secrets.
- Add a resource-bound argument such as