T09 · Insecure Skill Coding Practices
- Location
scripts/smyx_poop_clean_trigger_analysis.py:57- Finding
Shared fallback identity permits cross-user report access in multi-user workspaces
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_poop_clean_trigger_analysis.py:57-65;skills/smyx_common/scripts/util.py:455-470
Vulnerability Type: Improper identity binding and cross-user data isolation
Risk Level: HighComplete Code Snippet
scripts/smyx_poop_clean_trigger_analysis.py:57-65:python try: # Initialize the internal user identity without requesting or displaying it. OpenIdUtil.resolve_current_open_id(args.open_id, use_current=bool(args.open_id)) # Check required parameters if args.list: open_id = ConstantEnum.CURRENT__OPEN_ID result = show_analyze_list(open_id) print(result) exit(0)skills/smyx_common/scripts/util.py:455-470:python @classmethod def resolve_current_open_id(cls, open_id=None, use_current=True): """Resolve and initialize the current open-id, returning the final value.""" resolved_open_id = (open_id or "").strip() if isinstance(open_id, str) else open_id if not resolved_open_id and use_current: resolved_open_id = ConstantEnum.CURRENT__OPEN_ID or ConstantEnum.CURRENT__USER_NAME if not resolved_open_id: resolved_open_id = cls.get_api_key_file_open_id() if not resolved_open_id: resolved_open_id = cls.get_or_create_default_open_id() ConstantEnum.CURRENT__OPEN_ID = resolved_open_id if not ConstantEnum.CURRENT__USER_NAME: ConstantEnum.CURRENT__USER_NAME = resolved_open_id return resolved_open_idTechnical Analysis
The entry point sets
use_currenttobool(args.open_id). In the documented normal workflow, the hidden--open-idoption is omitted, makinguse_current=False. Consequently,resolve_current_open_iddoes not use an identity already supplied through the Agent environment inConstantEnum.CURRENT__OPEN_IDorConstantEnum.CURRENT__USER_NAME.Identity resolution instead falls back to a wo ...[truncated 2897 chars]
- Remediation
View remediation
Remediation Suggestions
-
Always prefer the authenticated upstream Agent identity when resolving the current user:
python OpenIdUtil.resolve_current_open_id(args.open_id, use_current=True) -
Do not use a workspace-global fallback identity in multi-user deployments. Store fallback identities in a user-scoped location or disable fallback behavior when no authenticated user identity is available.
-
Bind tokens and report records server-side to a verified upstream identity. Do not rely solely on caller-provided
openId,pnaUserName, or hidden CLI arguments for authorization. -
If
--open-idremains supported, verify that the requested identity is cryptographically associated with the authenticated caller. Reject arbitrary identity selection. -
Add explicit tenant and owner checks to report-list and report-detail endpoints so possession of a report identifier or shared local token cannot expose another user’s records.
-
Separate locally cached tokens by authenticated user and tenant rather than storing all identities in a workspace-shared database without access partitioning.
-
Add multi-user isolation tests covering two distinct upstream identities performing uploads, list queries, and report-detail access from the same workspace.
-
Migrate reports created under existing shared fallback identities into properly separated user accounts where ownership can be established.
-