T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:190- Finding
Read-Only Diagnostic Action Can Persistently Modify Workspace State and Agent Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:9-22;scripts/run.py:151-181,190-201
Vulnerability Type: Permission mismatch and persistent agent-state modification
Risk Level: MediumThe
harness_checktool is declared asread_only, but its optionalfix_applyparameter causes the implementation to write files in the current workspace. These writes include creating persistent session state and modifyingAGENTS.md, which can influence behavior in future agent sessions.Relevant Code
Tool declaration in
SKILL.md:9-22:yaml tools: - name: harness_check description: "Run full diagnostic on current agent harness. Returns scores, findings, and recommended actions." input_schema: type: object properties: fix_apply: type: array items: type: string description: "List of finding IDs to auto-fix (P0 only recommended)" required: [] permission: read_onlyMutation triggered from the supposedly read-only action in
scripts/run.py:190-201:python if action == "harness_check": result = run_diagnostic() # If fix_apply provided, apply those fixes automatically fix_ids = input_data.get("fix_apply", []) if fix_ids: applied = [] for fid in fix_ids: res = apply_fix(fid) if "error" not in res: applied.append(fid) else: res["applied"] = False result["applied_fixes"] = appliedPersistent write sinks in
scripts/run.py:151-181:python PROGRESS_FILE.write_text(json.dumps(template, indent=2)) return {"created": str(PROGRESS_FILE)} def fix_startup_sequence(): """Insert fixed startup sequence into AGENTS.md if missing""" if not AGENTS_FILE.exists(): return {"error": "AGENTS.md not found"} content = AGENTS_FILE.read_text() if "## Sess ...[truncated 3996 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
fix_applyfromharness_checkand make that action strictly diagnostic. - Require all mutations to use the separately declared
apply_fixtool, whosedanger_full_accesspermission can trigger an explicit approval flow. - If combined checking and fixing is required, change the declared permission to accurately reflect write access and require affirmative confirmation before each mutation.
- Present the target path and a proposed diff before changing
AGENTS.mdoragent-progress.json. - Create backups before replacing existing files, particularly
AGENTS.md. - Use atomic writes: create a temporary file in the same directory, flush and synchronize it, then replace the destination with
os.replace. - Prevent concurrent-update loss by checking file metadata or hashes before replacement.
- Validate that the resolved workspace and destination paths are within an explicitly authorized project root.
- Add tests asserting that every action declared
read_onlyleaves the workspace byte-for-byte unchanged. - Clearly document that fixes persist across sessions and identify every file that may be created or modified.
- Remove