T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/karakeep-script.sh:95
- Finding
- Bookmark deletion is not protected by the required confirmation control## Vulnerability Details **File Location**: `scripts/karakeep-script.sh`, lines 95–108 **Vulnerability Type**: Missing confirmation for a destructive operation **Risk Level**: Medium ### Vulnerable Code ```bash # Delete bookmark # Usage: kb-delete <bookmark_id> kb-delete() { check_config || return 1 local bookmark_id="$1" if [ -z "$bookmark_id" ]; then echo "Usage: kb-delete <bookmark_id>" return 1 fi curl -s -X DELETE "$KARAKEEP_API_URL/bookmarks/$bookmark_id" \ -H "Authorization: Bearer $KARAKEEP_API_KEY" echo "Deleted bookmark: $bookmark_id" } ``` ### Technical Analysis `SKILL.md` explicitly requires the user to be asked for confirmation before a bookmark is deleted. The implementation does not enforce that requirement: supplying a nonempty bookmark ID immediately sends an authenticated HTTP `DELETE` request. Relying only on an instruction in the documentation is insufficient because the function can be invoked directly by an agent, automation, or user without following the documented workflow. The function also uses silent `curl` output without `--fail` or HTTP status validation and unconditionally prints a deletion-success message. Consequently, unsuccessful requests can be represented as successful deletions. ### Attack Path 1. The script is sourced in an environment containing a valid `KARAKEEP_SERVER_URL` and `KARAKEEP_API_KEY`. 2. An agent, automation process, or user invokes `kb-delete` with the ID of an existing bookmark. 3. The function validates only that the ID is nonempty. 4. It immediately sends an authenticated `DELETE` request without prompting for confirmation or requiring an explicit confirmation token. 5. The targeted bookmark is deleted if the configured API key is authorized. 6. The function prints `Deleted bookmark` regardless of whether the server actually accepted the request. ### Impact Assessment Exploitation does not grant ...[truncated 440 chars]
- Remediation
- ## Remediation Suggestions - Require an explicit confirmation argument, such as `--confirm`, before issuing the request. - For interactive use, display the target bookmark ID and require an exact confirmation response. - Keep confirmation enabled by default; do not silently bypass it in noninteractive environments. - Consider separating preparation and execution so the agent can present the planned deletion before it occurs. - Use `curl --fail-with-body` and inspect the exit status or HTTP status code. - Print the success message only after the server confirms successful deletion. - Return a nonzero status on transport failures and non-successful HTTP responses. - Apply equivalent safeguards to other destructive operations where user intent should be reconfirmed. Example hardened pattern: ```bash kb-delete() { check_config || return 1 local bookmark_id="$1" local confirmation="$2" if [ -z "$bookmark_id" ]; then echo "Usage: kb-delete <bookmark_id> --confirm" return 1 fi if [ "$confirmation" != "--confirm" ]; then echo "Deletion requires explicit confirmation." return 1 fi if curl --fail-with-body -sS -X DELETE \ "$KARAKEEP_API_URL/bookmarks/$bookmark_id" \ -H "Authorization: Bearer $KARAKEEP_API_KEY"; then echo "Deleted bookmark: $bookmark_id" else echo "Failed to delete bookmark: $bookmark_id" >&2 return 1 fi } ```