T09 · Insecure Skill Coding Practices
Warning
- Location
- update.sh:32
- Finding
- Update Dry-Run Performs Privileged Network and Filesystem Mutations## Vulnerability Details **File Location**: `update.sh:32-63` **Vulnerability Type**: Dry-run safety contract violation **Risk Level**: Medium ### Vulnerable Code ```bash else # In dry-run mode, we need sudo for read operations SUDO="sudo" fi # Update package lists echo "Updating package lists..." $SUDO apt update # Show upgradable packages echo "" echo "Upgradable packages:" echo "--------------------" $SUDO apt list --upgradable 2>/dev/null | grep -v "^Listing" | head -20 # Count packages COUNT=$($SUDO apt list --upgradable 2>/dev/null | grep -v "^Listing" | wc -l) if [ "$COUNT" -eq 0 ]; then echo "" echo "✅ System is up to date!" exit 0 fi echo "" echo "Found $COUNT upgradable package(s)" echo "" # Exit early in dry run mode if [ "$DRY_RUN" = true ]; then echo "🔍 Dry run complete. These packages would be updated." echo " Run without --dry-run to apply updates." exit 0 fi ``` ### Technical Analysis The script advertises dry-run mode as making no changes, but assigns `SUDO="sudo"` in that mode and executes `sudo apt update` before reaching the dry-run exit. `apt update` is not a read-only operation: it contacts configured package repositories and modifies package-index state under `/var/lib/apt/lists` and related APT-managed paths. This violates the documented dry-run safety contract and unnecessarily requests elevated privileges for a preview operation. It can also trigger repository authentication, proxy access, metered network traffic, or interaction with an untrusted repository configured on the host. ### Attack Path 1. A user or automation system invokes `./skill.sh update --dry-run`, expecting a side-effect-free preview. 2. The wrapper forwards `--dry-run` to `update.sh`. 3. The script assigns `sudo` to `SUDO`. 4. `sudo apt update` contacts every configured APT repository. 5. APT downloads metadata and changes privileged local package-inde ...[truncated 506 chars]
- Remediation
- ## Remediation Suggestions - Do not run `apt update` in dry-run mode. - Use existing package indexes for the preview, or introduce a separately named and explicitly confirmed `--refresh` option. - Do not assign `sudo` for operations that only read publicly accessible APT state. - Clearly distinguish between a side-effect-free preview and a repository refresh. - Enable fail-safe shell behavior such as `set -euo pipefail` and check command exit statuses before reporting success. - Add a regression test that records relevant filesystem state and network calls to verify that `--dry-run` performs no writes or downloads.