T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_tasks.js:300- Finding
Fail-open operation selection may invoke an unrelated or destructive action
- Content
View full analysis
({ node, score: scoreRunCandidate(node) })) .sort((a, b) => b.score - a.score); if (candidates[0] && candidates[0].score > 0) { return candidates[0].node; } return getOperationCandidates(row)[0] || null; } ``` ### Technical Analysis The function first attempts to locate the expected run icon and then scores possible operation controls. However, when no candidate receives a positive score, it returns the first enabled operation control in the row. The candidate selector includes arbitrary buttons, links, and icon-like elements from the operation cell. Consequently, the fallback can return controls that were not identified as run actions. Even a candidate assigned a negative score because it appears to be a delete or pause action can become the fallback result. The returned element is subsequently clicked by `clickRunAndConfirm()`, which may also confirm the resulting dialog. This is a fail-open design: uncertainty about the intended control results in an action rather than a safe failure. ### Attack Path 1. A task row contains multiple operation controls, such as edit, delete, pause, and run. 2. The page layout or CSS classes change so the expected `iconzanting2` selector no longer identifies the run control. 3. None of the available controls receives a positive run score. 4. `getRunIcon()` returns the first enabled operation candidate regardless of its purpose. 5. `clickRunAndConfirm()` clicks that unrelated control. 6. If the action opens a confirmation dialo ...[truncated 700 chars]- Remediation
View remediation