T09 · Insecure Skill Coding Practices
- Location
scripts/worldctl.py:3681- Finding
Destructive state deletion does not enforce the documented user-confirmation boundary
- Content
View full analysis
Vulnerability Details
File Location:
scripts/worldctl.py:3513-3519,scripts/worldctl.py:3681-3758, andscripts/worldctl.py:7691-7692
Vulnerability Type: Missing authorization confirmation for destructive operations
Risk Level: MediumRelevant Code
Direct command dispatch invokes the deletion routine without requiring a confirmation token, interactive prompt, or
--forceflag:python elif args.action == "delete": sys.exit(0 if cmd_delete(world_dir, args.extra) else 1)Batch operations containing a deletion marker also invoke the same routine directly:
python for idx, (kind, file_key, key_path_str, content, append) in enumerate(ops): if idx in blocked: continue if kind == "delete": if cmd_delete(world_dir, [file_key, key_path_str]): written_count += 1 else: op_failures.append((idx, file_key, key_path_str)) continueThe deletion routine backs up the state file but then removes the selected key and writes the modified state without checking for user approval:
python try: bak_dir = world_dir / "tmp" bak_dir.mkdir(parents=True, exist_ok=True) bak = bak_dir / f"{filepath.name}.delete.{_ts()}.bak" shutil.copy2(filepath, bak) except Exception as e: print(f"[ERR] {e}", file=sys.stderr) return False del target[last] write_yaml(filepath, data) return TrueTechnical Analysis
The Skill documentation designates direct
deleteoperations and batch deletion markers as destructive operations that require explicit user confirmation. That authorization boundary is not implemented inworldctl.py.Both supported deletion paths reach
cmd_delete()without:- An interactive confirmation prompt.
- A required
--forceoption for non-interactive execution. - A short-lived confirmation token tied to the requested world and key.
- Evidence that the us ...[truncated 2230 chars]
- Remediation
View remediation
Remediation Suggestions
- Add a shared destructive-operation confirmation function and call it from both direct and batch deletion paths.
- In interactive mode, display the exact world, state file, and key path, then require an affirmative response with rejection as the default.
- In non-interactive mode, fail closed unless the caller supplies an explicit
--forceoption or a scoped confirmation token. - Bind any confirmation token to the world, file key, key path, and operation type so approval for one deletion cannot authorize another.
- Require separate approval for every batch deletion, or show the complete deletion set and approve it atomically before applying any operation.
- Perform confirmation before creating or modifying files, and revalidate the target after confirmation to reduce time-of-check/time-of-use inconsistencies.
- Preserve the existing backup and path-confinement safeguards, but treat them as recovery and containment controls rather than authorization controls.
- Add tests proving that direct and batch deletion fail in non-interactive mode without explicit authorization and that denial leaves all state files unchanged.