T09 · Insecure Skill Coding Practices
Error
- Location
index.js:18- Finding
Unscoped Termination of All Visible Agents and Processes Without Effective Confirmation
- Content
View full analysis
0) { for (const agent of subagentsList.active) { await subagents({ action: 'kill', target: agent.id }); result.killedSubagents++; } } } catch (error) { console.warn(error.message); } } if (cleanupProcesses) { try { const processList = await process({ action: 'list' }); if (processList.sessions && processList.sessions.length > 0) { for (const session of processList.sessions) { await process({ action: 'kill', sessionId: session.id }); result.killedProcesses++; } } } catch (error) { console.warn(error.message); } } ``` ```javascript export async function quickKill() { console.log('Quick interruption...'); const result = await killTask({ confirm: false, cleanupTempFiles: false }); console.log(result.message); return result; } ``` ### Technical Analysis The `confirm` option is accepted by `killTask`, but it is never evaluated before destructive operations begin. Consequently, its default value of `true` does not cause a confirmation check, and setting it to `false` in `quickKill` has no meaningful control-flow effect. The cleanup logic requests global-looking lists from the `subagents` and `process` tools and iterates over every returned active agent and process session. It performs no ownership, task, tenant, sessi ...[truncated 2483 chars]- Remediation
View remediation