T09 · Insecure Skill Coding Practices
Error
- Location
handler.js:727- Finding
Explicit Publish Confirmation Can Be Bypassed When an Account Is Supplied
- Content
View full analysis
({ id: a.appId, title: a.appName, data: { ...buildWorkflowPayload(session, { templateId: selectedTemplate.id, template: selectedTemplate.id, templateConfirmed: true, accountId: a.appId, accountName: a.appName, accountConfirmed: true, author: author || a.appName }) } })), action: 'select_account' } }; } ``` ```javascript const publishResult = await executePublish(api, { content, title, author: resolvedAuthor, digest, contentSourceUrl, coverImage, templateId: selectedTemplate.id, accountId: targetAccount.appId }); if (publishResult && publishResult.type === 'success') { clearWorkflowSession(workflowSessionId); } return publishResult; ``` ### Technical Analysis The workflow only displays the account-selection confirmation interface when `targetAccount` is absent. If request arguments contain a value that `findAccount()` can resolve, execution skips the interactive branch and proceeds directly to `executePublish()`. Although the generated account-selection payload contains `accountConfirmed: true`, the publishing path never validates that field. It also does not require a separate, server-side `publishConfirmed` state tied to the current workflow session. Consequently, ...[truncated 1884 chars]- Remediation
View remediation