T09 · Insecure Skill Coding Practices
Warning
- Location
campus/mail/scripts/mail.py:169- Finding
Email Mutations Lack Executable Confirmation Enforcement
- Content
View full analysis
Vulnerability Details
File Location:
campus/mail/scripts/mail.py, lines 169–207 and 236–241
Vulnerability Type: Missing authorization gate for externally visible and state-changing email operations
Risk Level: MediumComplete Code Snippet
python def cmd_send(from_name, to, subject, body, cc=""): accounts = _load_accounts() acc = _find_account(accounts, from_name) try: msg = MIMEText(body, "plain", "utf-8") msg["From"] = formataddr([acc.get("from_name", acc["user"]), acc["user"]], charset="utf-8") msg["To"] = to if cc: msg["Cc"] = cc msg["Subject"] = Header(subject, "utf-8") to_list = [to] + ([cc] if cc else []) if acc.get("smtp_ssl", True): server = smtplib.SMTP_SSL(acc["smtp_host"], int(acc.get("smtp_port", 465)), timeout=15) else: server = smtplib.SMTP(acc["smtp_host"], int(acc.get("smtp_port", 587)), timeout=15) server.starttls() server.login(acc["user"], acc["password"]) server.sendmail(acc["user"], to_list, msg.as_string()) server.quit() common.output_json({"status": "ok", "type": "send", "from": acc["user"], "to": to, "subject": subject, "message": "发送成功"}) except Exception as e: common.output_json({"status": "error", "message": f"发送失败: {str(e)[:100]}"}) sys.exit(1) def cmd_mark_read(account_name, uid): accounts = _load_accounts() acc = _find_account(accounts, account_name) try: imap = _connect_imap(acc) except Exception as e: common.output_json({"status": "error", "message": f"IMAP 连接失败: {str(e)[:100]}"}) sys.exit(1) try: imap.select("INBOX") if uid: imap.store(uid.encode(), "+FLAGS", "\\Seen") else: typ, data = imap.search(None, "UNSEEN") ...[truncated 3354 chars]- Remediation
View remediation
Remediation Suggestions
- Add an explicit
--confirmflag to the argument parser and pass it into every state-changing command. - Reject
sendandmark-readunless confirmation is present. - Without confirmation, return a structured dry-run preview containing:
- Selected account
- Exact To and Cc recipients
- Subject and complete body
- For
mark-read, the exact UIDs and number of messages that would be changed
- Require the confirmed execution to match the preview. Prefer generating a short-lived, integrity-protected confirmation token bound to the operation parameters so changed recipients or content require a new confirmation.
- Treat bulk
mark-readas a separate high-impact action and require explicit bulk confirmation rather than interpreting an omitted UID as automatic approval for all unread messages. - Enforce authorization in executable code rather than relying solely on
campus/mail/SKILL.md. - Add regression tests asserting that SMTP
sendmail()and IMAPstore()are never reached without valid confirmation.
- Add an explicit