T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:60
- Finding
- Destructive Container and Repository Cleanup Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 60–61 **Vulnerability Type**: Unsafe destructive command guidance **Risk Level**: Medium **Complete Code Snippet**: ```markdown - **Reuse containers, don't rebuild.** Building a Docker image per task is expensive. Build once, then reset state between runs (`docker exec git checkout HEAD && git clean -fd`). An agent task that shares one container across N modes is N× faster than rebuilding each time. - **Stale container cleanup before launching.** Previous crashed runs leave `sweb.eval.*` containers sitting around consuming memory. Always run `docker ps -a --filter | xargs docker rm -f` before starting a new batch. ``` ### Technical Analysis The Skill recommends destructive cleanup operations as routine performance practices without requiring confirmation, target validation, or a dry-run preview. `git clean -fd` permanently deletes untracked files and directories in the active repository. The preceding `git checkout HEAD` is also incomplete as written because it does not specify a path, while `docker exec` does not identify a target container. If an agent repairs or adapts the example, the resulting reset can still destroy uncommitted or generated data in a reused container. The Docker command is malformed because `docker ps -a --filter` provides no filter expression and does not request ID-only output. It also contradicts the surrounding statement that cleanup should apply only to `sweb.eval.*` containers. If corrected mechanically or adapted into a functioning pipeline, `docker rm -f` may receive unrelated container identifiers or otherwise operate beyond the intended evaluation scope. The imperative phrase “Always run” increases the likelihood that an agent will execute a destructive operation without obtaining informed user approval. ### Attack Path 1. A user requests performance optimization for a Docker-based batch or evaluation workflow. 2. The Skill activat ...[truncated 1024 chars]
- Remediation
- ## Remediation Suggestions - Remove the unconditional “Always run” instruction and require explicit user confirmation before destructive cleanup. - Restrict Docker selection with an exact project-owned label or validated name filter, and request only container IDs. For example, use a dedicated label such as `label=com.example.owner=sweb-eval`. - Store candidate IDs first, reject an empty or unexpectedly broad selection, display the exact container names and IDs, and obtain approval before calling `docker rm -f`. - Prefer graceful container shutdown and normal removal before force removal. - Run cleanup under a Docker context with access only to project-owned resources rather than a shared or privileged daemon. - Verify that the repository is a disposable workspace before resetting it. - Run `git clean -nd` first to preview deletions. Require confirmation before changing it to `git clean -fd`. - Preserve required generated artifacts and uncommitted work outside the reset workspace. - Replace the incomplete examples with commands that explicitly identify the target container and repository working directory.