T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:39
- Finding
- Resumed Plans Bypass Confirmation and Execute Untrusted Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 39–100 **Vulnerability Type**: Untrusted instruction execution with confirmation bypass **Risk Level**: Medium ### Vulnerable Code ```markdown ### 如果提供了路径参数 - 直接使用它作为计划文件路径 - 读取文件并继续 Step 2 ### 恢复检测 读取计划后，扫描文件中的所有复选框标记（`- [ ]` 和 `- [x]`）： - **如果存在任何 `- [x]`** → 这是**恢复执行**： - 完全跳过执行前确认 - 找到仍然包含至少一个 `- [ ]` 步骤的第一个 Task - 在该 Task 中，识别第一个未勾选的步骤（`- [ ]`）作为恢复点 - 打印："从 Task N: [任务名] 恢复执行，步骤: [步骤描述]" - 从恢复点直接继续 Step 3 ### 对于每个 Task： 1. **执行所有执行步骤**（在 `**执行步骤:**` 下）： - 按顺序处理每个 `- [ ]` 步骤 - 步骤完成后，**立即**更新计划文件：将该步骤的 `- [ ]` 改为 `- [x]` - **跳过**已标记为 `- [x]` 的步骤（恢复执行场景） 2. **运行所有检查步骤**（在 `**检查步骤:**` 或 `**End-to-end verification:**` 下）： - 按顺序处理每个 `- [ ]` 检查 - 检查通过后，**立即**更新计划文件：将该检查的 `- [ ]` 改为 `- [x]` - **跳过**已标记为 `- [x]` 的检查（恢复执行场景） ``` ### Technical Analysis The skill accepts a caller-provided plan path and treats the contents of that plan as executable agent instructions. It does not require the plan to reside under the configured workspace, validate its provenance, canonicalize the path, inspect requested operations against a safety policy, or restrict the commands and files that plan steps may reference. The resume-state logic creates a confirmation bypass: the presence of any completed checkbox (`- [x]`) causes the skill to classify the plan as a resumed execution and skip pre-execution confirmation entirely. An attacker who can provide or modify a plan can therefore add one completed checkbox and place attacker-controlled operations in unchecked steps. The execution loop instructs the agent to process those remaining steps autonomously. This is an insecure trust-boundary design rather than evidence of an embedded malicious payload. The project contains no scripts demonstrating a specific destructive command, and exploitation depends on an attacker controlling a selected plan and on the tools and permissions av ...[truncated 1643 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation for every newly selected plan, including plans classified as resumed. Resume state must not act as authorization. 2. Resolve the selected plan to a canonical path and require it to remain inside the configured workspace or another explicitly approved directory. Reject absolute paths, traversal outside the allowed root, and unsafe symbolic-link targets. 3. Display the plan path, pending steps, proposed commands, affected files, and requested network destinations before execution. 4. Validate plan steps against an allowlist of permitted operations. Require separate confirmation for shell execution, network access, credential-related paths, destructive file operations, and changes outside the project. 5. Track resume state in trusted metadata rather than inferring authorization from attacker-editable Markdown checkboxes. 6. Record plan identity or a content digest when approval is granted. If the plan changes after approval, invalidate the approval and request confirmation again. 7. Execute with least privilege by limiting filesystem access, network access, environment variables, subprocess capabilities, and available tools to those required by the approved task. 8. Treat all plan content as untrusted data and ensure it cannot override system-level safety requirements or authorize operations solely through text contained in the plan.