T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/todo.sh:138
- Finding
- Ambiguous Fuzzy Matching Allows Unintended Reminder Modification or Deletion## Vulnerability Details **File Location**: `scripts/todo.sh`, lines 138–216; vulnerable matching and mutation operations occur at lines 146–159, 182–183, and 205–207. **Vulnerability Type**: Ambiguous object selection and missing input validation in destructive operations **Risk Level**: Medium ### Complete Vulnerable Code Snippets **Completion operation (`scripts/todo.sh`, lines 146–161):** ```applescript repeat with rem in reminders of default list if name of rem contains searchTitle then set completed of rem to true set completion date of rem to current date set found to true return "Completed: " & name of rem end if end repeat -- Search all lists if not found if not found then repeat with aList in lists repeat with rem in reminders of aList if name of rem contains searchTitle then set completed of rem to true set completion date of rem to current date return "Completed: " & name of rem & " (in '" & name of aList & "')" end if end repeat end repeat end if ``` **Uncompletion operation (`scripts/todo.sh`, lines 180–187):** ```applescript repeat with aList in lists repeat with rem in reminders of aList if name of rem contains searchTitle then set completed of rem to false set completion date of rem to missing value return "Uncompleted: " & name of rem end if end repeat end repeat ``` **Deletion operation (`scripts/todo.sh`, lines 203–210):** ```applescript repeat with aList in lists repeat with rem in reminders of aList if name of rem contains searchTitle then set remName to name of rem delete rem return "Deleted: " & remName end if end repeat end repeat ``` ### Technical Analysis The `complete`, `uncomplete`, and `delete` actions select a reminder using the AppleScript `contains` operator and ...[truncated 2464 chars]
- Remediation
- ## Remediation Suggestions 1. Reject missing and empty search terms before invoking AppleScript: ```bash if [[ -z "${1:-}" ]]; then echo "Error: A non-empty reminder title or identifier is required." >&2 exit 2 fi ``` 2. Search for an exact title match before performing substring matching. 3. If substring matching produces more than one result, do not mutate any reminder. Return the matching reminders with their list names and stable identifiers, then require the caller to select one explicitly. 4. Use a stable Reminders identifier for `complete`, `uncomplete`, and `delete` operations rather than relying solely on a mutable, non-unique title. 5. Require explicit confirmation before deletion, particularly when the match was not exact. For noninteractive automation, support an explicit flag such as `--confirm` or require the exact reminder identifier. 6. Return a nonzero exit status for empty input, missing reminders, ambiguous matches, invalid arguments, and unsuccessful mutations so callers can reliably detect failure. 7. Add regression tests covering empty strings, duplicate titles, common substrings, reminders in multiple lists, exact matches, and deletion cancellation.