T09 · Insecure Skill Coding Practices
- Location
scripts/company_list_search.py:107- Finding
Fee-Generating API Operations Lack Enforced User Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/company_list_search.py:107-112
Additional Locations:scripts/trade_list_search.py:102-107,scripts/company_get_details.py:41-46,scripts/company_get_contact.py:43-48
Vulnerability Type: Missing authorization enforcement for fee-generating operations
Risk Level: MediumTechnical Analysis
SKILL.md:99-124states that all API calls incur fees and requires the agent to disclose the expected usage, stop, and wait for explicit user confirmation in a separate message. The executable entry points do not enforce that requirement.The company-list search begins its charged pagination loop immediately:
python print(f"开始查询：目标获取 {args.query_count} 条数据...") while total_retrieved < args.query_count: try: # 搜索当前批次 response = search_company_list(params, current_cursor)The trade-list search has the equivalent behavior:
python print(f"开始查询：目标获取 {args.query_count} 条数据...") while total_retrieved < args.query_count: try: # 搜索当前批次 response = search_trade_list(params, current_cursor)The company-details entry point validates only the batch-size limit before issuing the request:
python company_ids = args.companyIds if len(company_ids) > 20: print(f"错误：每次最多处理20条数据", file=sys.stderr) sys.exit(1) response = get_company_details(company_ids)The contact-retrieval entry point behaves identically:
python company_ids = args.companyIds if len(company_ids) > 20: print(f"错误：每次最多处理20条数据", file=sys.stderr) sys.exit(1) response = get_contact_info(company_ids)These calls reach
make_request(), which loads the account API key and sends an authenticated request to the service. There is no confirmation parameter, short-lived approval token, interactive prompt, dry-run mode, or durable approval record bound to the requested operation.Consequently, the documentation-only confirmation gate can be bypassed whenever a ...[truncated 1640 chars]
- Remediation
View remediation
Remediation Suggestions
- Require a non-default, verifiable approval artifact for every charged operation rather than relying only on instructions in
SKILL.md. - Generate approval tokens only after presenting the exact operation, account, parameters, maximum request count, and applicable pricing information to the user.
- Bind each token cryptographically or through protected local state to:
- The specific endpoint.
- A normalized hash of the request parameters.
- The account identity.
- The maximum number of API calls or company IDs.
- A short expiration time.
- A unique nonce to prevent replay.
- Reject execution when the approval token is absent, expired, replayed, or does not match the operation.
- For paginated searches, enforce the approved request ceiling inside the loop and stop before issuing any additional request.
- Add a dry-run mode that reports the expected request count without contacting a fee-generating endpoint.
- Apply the same enforcement to new searches, resumed tasks, company-detail retrieval, and contact retrieval.
- Add automated tests proving that direct script invocation without valid approval cannot reach
make_request().
- Require a non-default, verifiable approval artifact for every charged operation rather than relying only on instructions in