T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:18
- Finding
- Unscoped Termination of All Visible Agents and Processes Without Effective Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `index.js:18-24`, `index.js:35-62`, and `index.js:101-108` **Vulnerability Type**: Unscoped destructive resource management and ineffective authorization confirmation **Risk Level**: High ### Vulnerable Code ```javascript const { confirm = true, cleanupSubagents = true, cleanupProcesses = true, cleanupTempFiles = true, tempDir = './.temp' } = options; ``` ```javascript if (cleanupSubagents) { try { const subagentsList = await subagents({ action: 'list' }); if (subagentsList.active && subagentsList.active.length > 0) { for (const agent of subagentsList.active) { await subagents({ action: 'kill', target: agent.id }); result.killedSubagents++; } } } catch (error) { console.warn(error.message); } } if (cleanupProcesses) { try { const processList = await process({ action: 'list' }); if (processList.sessions && processList.sessions.length > 0) { for (const session of processList.sessions) { await process({ action: 'kill', sessionId: session.id }); result.killedProcesses++; } } } catch (error) { console.warn(error.message); } } ``` ```javascript export async function quickKill() { console.log('Quick interruption...'); const result = await killTask({ confirm: false, cleanupTempFiles: false }); console.log(result.message); return result; } ``` ### Technical Analysis The `confirm` option is accepted by `killTask`, but it is never evaluated before destructive operations begin. Consequently, its default value of `true` does not cause a confirmation check, and setting it to `false` in `quickKill` has no meaningful control-flow effect. The cleanup logic requests global-looking lists from the `subagents` and `process` tools and iterates over every returned active agent and process session. It performs no ownership, task, tenant, sessi ...[truncated 2483 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Implement real confirmation enforcement** - Require an explicit, authenticated confirmation response before any destructive tool call. - Do not represent confirmation as a boolean supplied by the same caller initiating termination. - Use a short-lived confirmation token tied to the requesting user, current task, and proposed resource IDs. 2. **Restrict cleanup to resources owned by the current task** - Record subagent IDs and process session IDs when the task creates them. - Terminate only IDs found in that task-specific registry. - Verify task ID, session ID, owner ID, or an equivalent immutable ownership attribute before each termination call. 3. **Remove global list-and-kill behavior** - Avoid enumerating all visible resources. - If enumeration is unavoidable, filter the results by trusted ownership metadata and reject resources without verifiable ownership. - Never assume that visibility implies authorization to terminate. 4. **Separate local and global cleanup** - Make task-local cleanup the default. - Place administrator-wide cleanup behind a separate privileged operation with explicit warnings, reauthentication, and audit logging. - Do not expose global cleanup through broad natural-language triggers. 5. **Narrow activation conditions** - Prefer explicit commands or exact interruption requests over ambiguous terms. - Require additional confirmation when activation comes from ordinary conversational text. - Bind interruption commands to the user who owns the active task. 6. **Improve failure handling and auditability** - Record each proposed resource, ownership decision, termination result, and error. - Do not set `interrupted` to `true` unconditionally when termination operations fail. - Return partial-failure status so callers can distinguish complete, partial, and unsuccessful cleanup. 7. **Add security tests** - Verify that resources belonging to other ...[truncated 308 chars]