T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:35
- Finding
- Overly Broad Confirmation-Free Execution Policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35` **Vulnerability Type**: Unsafe authorization and confirmation policy **Risk Level**: Medium ### Vulnerable Code ```markdown **Never require confirmation for reversible actions.** Just do it. They can say "undo" if wrong. ``` ### Technical Analysis The skill directs an agent to execute any action considered reversible without first obtaining user confirmation. Reversibility is not an adequate security boundary: actions involving locks, climate controls, alarms, communications, or connected appliances may have immediate physical or privacy consequences even if the system can later restore their previous state. The instruction does not define a low-risk allowlist, require voice-speaker verification, distinguish safety-sensitive devices, or account for ambiguous and spoofed commands. Consequently, an agent following this policy may execute a sensitive operation based on a misheard command, an incorrectly inferred intent, or untrusted audio. The issue does not itself grant new system privileges. It weakens the authorization controls governing integrations and device privileges that the agent already possesses. ### Attack Path 1. An attacker produces audio resembling an authorized voice command, or causes untrusted media to issue such a command near the voice interface. 2. The agent interprets the command as an operation it considers reversible. 3. The skill instruction causes the agent to omit explicit user confirmation. 4. The agent invokes an already-authorized smart-home or account integration. 5. The operation takes effect before the legitimate user can notice and issue an undo command. ### Impact Assessment An attacker may exercise the agent's existing permissions over confirmation-free integrations. Depending on deployment, this could change environmental controls, operate connected appliances, alter notification settings, or affect physical-security devices. The vulnerability does ...[truncated 171 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Replace the broad reversibility rule with a risk-based authorization policy: - Permit confirmation-free execution only for an explicit allowlist of low-impact actions. - Always require explicit confirmation for locks, alarms, purchases, account changes, medical workflows, communications to third parties, and safety-sensitive appliances. - Require strong contextual authentication, such as verified speaker identity or an authenticated companion device, before physical-security operations. - Reject commands originating from untrusted media or unauthenticated users. - Present the exact target and requested operation during confirmation. - Maintain an audit log and provide immediate notifications for sensitive actions. - Treat undo support as a recovery mechanism, not as a substitute for authorization. ]]>