T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:177
- Finding
- Predictable and Colliding Todo Identifiers Can Modify or Delete Unrelated Tasks## Vulnerability Details **File Location**: `SKILL.md:177-180, 241-244, 355-358, 382-386` **Vulnerability Type**: Non-unique predictable identifiers and unsafe record selection **Risk Level**: Medium ### Vulnerable Code ```python # Generate ID todo_id = datetime.now().strftime("%Y%m%d%H%M")[:10] ``` The generated identifier is subsequently trusted by status and progress update operations: ```python for todo in data["todos"]: if todo["id"] == todo_id: todo["status"] = new_status ``` ```python for todo in data["todos"]: if todo["id"] == todo_id: # Check progress type prog = todo.get("progress") ``` Deletion removes every task with the supplied identifier: ```python def delete_todo(todo_id): """Delete a todo""" data = load_todos() data["todos"] = [t for t in data["todos"] if t["id"] != todo_id] save_todos(data) ``` ### Technical Analysis `datetime.now().strftime("%Y%m%d%H%M")` produces a 12-character value in the form `YYYYMMDDHHMM`. Truncating it to ten characters produces `YYYYMMDDHH`, so all todos created during the same hour receive the same identifier. This contradicts the documented requirement that `id` be unique. Update operations stop after finding the first matching identifier, meaning they can modify an unintended task. The deletion operation filters out all matching records and therefore deletes every task created during the same hour. The identifier is also predictable because it is derived solely from the current local time. No uniqueness check is performed before the task is appended. ### Attack Path 1. A legitimate task is created during a particular hour and receives an identifier such as `2026091614`. 2. Another task is created during the same hour, whether accidentally or by a user able to add tasks. 3. The second task receives the same identifier. 4. A status or progress update using that identifier changes the first matching task rather than necessarily changing the intended task. 5. ...[truncated 719 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the timestamp-derived identifier with a collision-resistant value: ```python from uuid import uuid4 todo_id = str(uuid4()) ``` 2. If sortable identifiers are required, combine a high-resolution timestamp with a cryptographically random suffix. 3. Before insertion, verify that the generated identifier is not already present. 4. For update and deletion operations, require exactly one matching record. Reject the operation if zero or multiple records match. 5. Change deletion to locate and remove one uniquely identified record rather than filtering out every matching record. 6. Add tests that create multiple tasks in the same second and verify that all identifiers remain unique.