T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:399- Finding
Destructive deletion tools do not technically enforce user confirmation
- Content
View full analysis
{ const text = await callRemoteTool("delete_monitor", { monitor_id, name }); return { content: [ { type: "text", text: `[Inform the user about the success of this deletion based on this JSON]:\n${text}`, }, ], }; }, ); ``` The equivalent `delete_watchdog` handler at `index.js:419-439` has the same weakness. ### Technical Analysis The requirement for explicit confirmation is present only in the behavioral prompt and tool description. These are advisory instructions to the Agent, not security controls enforced by the tool implementation. The deletion handlers accept a resource identifier and immediately forward the destructive operation to the remote Watch.dog API using the configured account API key. They do not require a confirmation parameter, verify a short-lived authorization token, maintain confirmation state, or reject direct calls made without a preceding confirmation exchange. Consequently, an MCP client, a malfunctioning Agent, or an Agent influenced by prompt injection can bypass the documented confirmation workflow and invoke the deletion tool directly. The schemas also allow both identifiers to be omitted or supplied simultaneously, leaving ambiguous requests to the remote service. ### Attack Path 1. An attacker influences the Agent through malicious content, or an MCP client directly issues a `delete_monitor` or `delete_watchdog` tool call. 2. The caller supplies a ...[truncated 770 chars]- Remediation
View remediation