T09 · Insecure Skill Coding Practices
Error
- Location
scripts/rate-limit-recovery.sh:24- Finding
Unsafe Automatic Keystroke Injection Across All tmux Panes
- Content
View full analysis
/dev/null | while read -r PANE_ID; do # Capture last 20 lines CONTENT=$(tmux capture-pane -p -t "$PANE_ID" -S -20 2>/dev/null || echo "") [ -z "$CONTENT" ] && continue # Check for rate limit patterns if echo "$CONTENT" | grep -qiE '(rate.?limit|429|Too Many Requests|try again in|Retry-After|overloaded_error)'; then # Check cooldown COOLDOWN_FILE="${COOLDOWN_DIR}/${PANE_ID//\//_}" if [ -f "$COOLDOWN_FILE" ]; then LAST=$(cat "$COOLDOWN_FILE" 2>/dev/null || echo "0") NOW=$(date +%s) ELAPSED=$((NOW - LAST)) if [ "$ELAPSED" -lt "$COOLDOWN_SECONDS" ]; then continue fi fi # Send Enter to resume tmux send-keys -t "$PANE_ID" Enter 2>/dev/null || true date +%s > "$COOLDOWN_FILE" echo "Recovered pane $PANE_ID (rate limit detected)" >&2 fi done ``` ### Technical Analysis The script enumerates every pane in the current user's tmux server and sends an Enter keystroke whenever any of the previous 20 lines contains a broad rate-limit pattern. The matched text does not have to be the pane's current prompt. It may be stale terminal history, command output, source code, documentation, or attacker-controlled text. The script does not: - Restrict scanning to panes explicitly registered as managed agent sessions. - Verify the foreground process in the pane. - Recapture the pane immediately before sending input. - Confirm that the final lines still contain an active rate-limit prompt. - Reject destructive confirmation prompts. - Require evidence that the rate limit has expired. This contradicts the mandatory safety procedure documented in `SKILL.md:41` and `references/rate-limit.md:25-39`, which requires a second capture and rejection of confi ...[truncated 1720 chars]- Remediation
View remediation
/dev/null || true) ``` 4. Require the current final lines—not older scrollback—to contain a narrowly defined rate-limit prompt. 5. Reject confirmation and destructive-operation indicators, including: ```text [y/N], [Y/n], [yes/no], confirm, delete, overwrite, force push ``` 6. Prefer notification and manual recovery over automatic input when confidence is incomplete. 7. Confirm that the retry time has elapsed where a `Retry-After` value is available. 8. Add tests using a mocked `tmux` executable for: - Stale rate-limit text followed by a normal prompt. - Destructive confirmation prompts. - Unmanaged panes. - Changed pane content between initial detection and action. - Valid, current rate-limit prompts. 9. Fail closed: if process verification, recapture, or parsing fails, do not send any keystroke. ]]>