T09 · Insecure Skill Coding Practices
Error
- Location
scripts/meta_ads_agent.py:238- Finding
Mutation approval is not cryptographically or semantically bound to the requested operation
- Content
View full analysis
bool: if not text: return False compact = " ".join(text.strip().split()) return len(compact) >= 25 and compact.lower() not in GENERIC_APPROVALS def safety_problem(cls: Dict[str, Any], approved: Optional[str], allow_active: bool, allow_budget: bool, allow_destructive: bool, allow_unknown: bool) -> Optional[str]: if cls.get("secret_arg_signals"): return "Do not pass access tokens or secrets as CLI arguments. Put credentials in environment variables or official auth storage." if cls["risk"] == "non_meta": return "Refusing to run non-`meta ads` command through this guard." if cls["risk"] == "unknown" and not allow_unknown: return "Unknown CLI action. Check `meta ads --help`; use --allow-unknown only after review." if cls["requires_approval"] and not approval_is_specific(approved): return "Write or unknown-risk command requires --approved with specific user approval, not a generic yes/ok." if cls["requires_allow_active"] and not allow_active: return "Activation requires --allow-active plus specific approval." if cls["requires_allow_budget"] and not allow_budget: return "Budget/bid/spend change requires --allow-budget plus specific approval." if cls["requires_allow_destructive"] and not allow_destructive: return "Destructive command requires --allow-destructive plus specific approval." return None ``` The direct command execution path accepts either command-line or reusable environment-based approval: ```python def cmd_run(args: argparse.Namespace) -> int: raw = strip ...[truncated 4246 chars]- Remediation
View remediation