T09 · Insecure Skill Coding Practices
- Location
scripts/trek-mcp.mjs:521- Finding
Generic Tool Invocation Bypasses High-Risk Operation Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/trek-mcp.mjs, lines 521–523 and 568–573
Vulnerability Type: Missing authorization gate for destructive operations
Risk Level: MediumVulnerable Code
js if (command === 'call') { if (!args[0] || args.length > 2 || args.some(arg => arg.startsWith('--'))) throw new Error('invalid_arguments: usage: trek call TOOL @args.json'); parseJsonArg(args[1]); }js if (command === 'call') { const [name, jsonArg] = args; if (!name) throw new Error('call requires a tool name'); if (!names.has(name)) throw new Error(`unknown/unavailable tool: ${name}`); return print(await client.callTool(name, parseJsonArg(jsonArg))); }The batch interface implements a separate safeguard:
js if (!args.includes('--apply')) return print({ ok: true, dryRun: true, count: actions.length, actions }); const risky = actions.filter((action) => highRisk.test(action.tool)).map((action) => action.tool); if (risky.length && !args.includes('--confirm-high-risk')) throw new Error(`high-risk tools require --confirm-high-risk: ${[...new Set(risky)].join(', ')}`);Technical Analysis
The generic
trek callcommand accepts any tool returned by the remote MCP server’stools/listresponse. Its only authorization check is whether the requested tool name appears in that server-provided list. It does not apply thehighRiskclassification, require--confirm-high-risk, or provide a dry-run stage.Consequently, destructive tools such as
delete_trip, as well as other server-listed tools whose names represent removal, decision, scheduling, settlement, restoration, or credential rotation, can be invoked directly throughtrek call. This bypasses the safeguards enforced by thebatchcommand and the preview requirement documented in the Skill workflow.The MCP server may still enforce account permissions, so this does not grant access beyond the configured Trek key. However, the configured key is documente ...[truncated 1771 chars]
- Remediation
View remediation
Remediation Suggestions
-
Apply the high-risk operation check to the
callcommand before invokingclient.callTool():- Classify the requested tool using the same policy as batch execution.
- Reject high-risk tools unless an explicit confirmation option is present.
- Require a distinct apply flag or confirmation artifact so merely constructing a command cannot execute the mutation.
-
Prefer a strict, centrally maintained policy over name matching:
- Use trusted server metadata that identifies read-only, mutating, destructive, financial, membership, and credential-management tools.
- If such metadata is unavailable, maintain a local allowlist of read-only tools and treat unknown mutating tools as high risk by default.
-
Enforce the confirmation boundary in executable code rather than relying solely on instructions in
SKILL.md. -
For destructive operations, display a structured preview containing the tool name, target trip or resource identifier, and affected action before execution.
-
Require post-operation readback and clearly report partial or uncertain outcomes.
-
Add regression tests proving that:
trek call delete_trip ...is rejected without explicit confirmation.- Other classified high-risk tools are similarly rejected.
- Read-only calls continue to work without unnecessary confirmation.
- Newly exposed or unknown mutating tools fail closed.
-