T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:42
- Finding
- Autonomous code execution is enabled through unrestricted automatic approval## Vulnerability Details **File Location**: `SKILL.md:42-52`; `scripts/test_cline.sh:37-55` **Vulnerability Type**: Unsafe automatic approval of AI-generated operations **Risk Level**: High ### Complete Code Snippet From `SKILL.md`: ```bash # Execute code in automatic approval mode cline task "Create a simple web server" --act --yolo --verbose --json ``` The documentation states that `--yolo` automatically approves all operations and promotes it as the default approach. From `scripts/test_cline.sh`: ```bash # Test Cline planning mode echo "=== Testing Cline planning mode ===" if cline task "Create a simple Hello World program" --plan --yolo --verbose --json; then echo "Cline planning mode completed successfully" else echo "Cline planning mode failed" exit 1 fi echo "" # Test Cline execution mode echo "=== Testing Cline execution mode ===" if cline task "Create a simple Hello World program" --act --yolo --verbose --json; then echo "Cline execution mode completed successfully" else echo "Cline execution mode failed" exit 1 fi ``` ### Technical Analysis The skill invokes an AI programming tool in execution mode with the `--yolo` option. This option removes interactive approval boundaries and permits operations proposed by the model to proceed automatically. AI-generated operations may include shell commands, file creation or modification, package installation, network requests, and execution of generated programs. The effective operation is influenced not only by the explicit task but potentially by repository content, dependency output, external data, and model behavior. Automatically approving such operations therefore violates least-privilege and human-in-the-loop security principles. The test script also performs a live execution task rather than limiting itself to passive checks such as displaying the version or validating command syntax. Running the test can ...[truncated 1497 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--yolo` from all default commands, examples, and test cases. 2. Require explicit approval for command execution, file writes, package installation, credential access, and network activity. 3. Replace the live execution test with passive checks such as `cline --version`, `cline help`, or a dry-run mode that cannot execute tools. 4. Run Cline in an isolated container or sandbox with: - A dedicated unprivileged account. - Read-only access to source files unless writes are specifically required. - A narrowly scoped writable workspace. - No access to home-directory credentials, SSH keys, cloud tokens, or system configuration. - Network access disabled by default or restricted through an allowlist. 5. If automation is essential, use a narrowly defined operation allowlist rather than approving every generated action. 6. Display the exact generated commands, file changes, and network targets before execution and require approval for any deviation. 7. Add a prominent warning that repository and task content must be treated as untrusted input.