T09 · Insecure Skill Coding Practices
- Location
SKILL.md:124- Finding
Destructive File Deletion Is Incorrectly Classified for Immediate Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 124, with conflicting safety requirements at lines 28, 42, and 82
Vulnerability Type: Unsafe handling of irreversible filesystem operations
Risk Level: MediumVulnerable Code Segment
The following is an English rendering of the relevant rule and test case:
markdown | Irreversibility | +2 | Irreversible operations or operations involving real assets or production environments | Tier override: If irreversibility is triggered, automatically elevate the score to 8+ and require forced reasoning. Applicable scenario: - Analysis before an irreversible operation | Test 2 | "Delete this file" | 2 points → execute directly |The test case on line 124 directly conflicts with the irreversible-operation requirements established on lines 28, 42, and 82.
Technical Analysis
The skill defines file deletion as a low-complexity operation that should be executed immediately. However, deletion is normally irreversible and should therefore activate the skill's tier-override rule, requiring a score of at least eight and additional review.
Examples and expected test outcomes may be treated as normative instructions by an agent. When the general safety rule and the explicit deletion example conflict, an agent may follow the more specific test case and perform deletion without:
- Verifying the target path and its scope.
- Confirming that the requester is authorized.
- Determining whether the target is a file, directory, symbolic link, or sensitive system resource.
- Assessing dependencies and operational impact.
- Confirming that backups or recovery mechanisms exist.
- Asking for confirmation immediately before the destructive action.
- Preferentially using a reversible trash or quarantine operation.
This is an unsafe skill configuration rather than command injection or privilege escalation. Exploitation depends on the consuming agent having a filesystem deletion tool and sufficient operati ...[truncated 1322 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the Test 2 expected behavior with forced reasoning and explicit confirmation:
markdown | Test 2 | "Delete this file" | Irreversibility triggered → forced reasoning, validation, and confirmation | -
State explicitly that authorization and safety requirements always take precedence over complexity scoring and example test cases.
-
Require the agent to resolve and normalize the target path before any deletion, then reject:
- Empty or ambiguous paths.
- Filesystem roots and broad wildcard targets.
- Paths outside the authorized workspace.
- Unexpected symbolic links.
- Sensitive system, credential, or production paths.
-
Require a preview of the exact deletion scope and explicit user confirmation immediately before execution.
-
Prefer reversible operations such as moving content to trash or quarantine. Permanent deletion should require a separate, clearly stated request.
-
Require backup, snapshot, or recovery verification for important files and production data.
-
For recursive or production deletion, require elevated review and prohibit unattended immediate execution.
-
Add regression tests verifying that
rm, recursive deletion, formatting, data migration, and comparable irreversible operations always activate the tier override.
-