T09 · Insecure Skill Coding Practices
Warning
- Location
knowledge-base/scripts/tag_delete.cjs:18- Finding
Destructive API operations lack code-enforced confirmation gates
- Content
View full analysis
Vulnerability Details
File Locations:
knowledge-base/scripts/tag_delete.cjs:18-24knowledge-base/scripts/tag_rename.cjs:18-25knowledge-base/scripts/join_knowledge.cjs:18-33knowledge-base/scripts/update_knowledge_base_permission.cjs:22-43notes/scripts/notes_append.cjs:46-66notes/scripts/note-images.cjs:271-275
Vulnerability Type: Destructive authenticated operations without executable confirmation enforcement
Risk Level: MediumTechnical Analysis
SKILL.md:67requires explicit user confirmation before deleting or merging tags, joining a public knowledge base, changing knowledge-base permissions, or appending to an existing note. However, the executable scripts do not require a confirmation token, mandatory preview, or interactive confirmation before issuing the authenticated API requests.For example, tag deletion proceeds directly from command-line arguments to the destructive API call:
js const args = parseArgs(process.argv); await __withRetry(args, async () => { if (!args['tag-name']) { console.error('[error] 缺少必需参数 --tag-name <标签名>'); process.exit(1); } const kbId = await resolveKbId(args); const body = { knowledge_base_id: kbId, tag_name: args['tag-name'] }; log('⏳', `删除标签「${args['tag-name']}」（关联自动解除）…`); await call('openapi/wiki/v1/tag_delete', body); log('✅', `标签已删除：${args['tag-name']}`); });Tag renaming, which can merge an existing tag and remove the old association, also lacks enforcement:
js const args = parseArgs(process.argv); await __withRetry(args, async () => { if (!args['old-tag-name']) { console.error('[error] 缺少必需参数 --old-tag-name <旧标签名>'); process.exit(1); } if (!args['new-tag-name']) { console.error('[error] 缺少必需参数 --new-tag-name <新标签名>'); process.exit(1); } const kbId = await resolveKbId(args); const body = { knowledge_base_id: kbId, old_tag_name: args['old-tag-name'], new_tag_name: args['new-tag-name'] }; log('⏳', `重命名标签「${args['old-tag-name ...[truncated 5162 chars]- Remediation
View remediation
Remediation Suggestions
- Require an explicit confirmation flag, such as
--confirm, for every destructive or irreversible operation. - Bind confirmation to the exact operation by generating a preview containing the resolved resource name, target identifier, requested changes, and a digest or one-time confirmation token.
- Reject execution if the supplied confirmation token does not match the previewed operation.
- Make dry-run or preview behavior the default for tag deletion, tag merging, permission changes, knowledge-base joining, and note appends.
- For
note-images.cjs, obtain confirmation before the first append request and display the number and total size of batches. Avoid requesting confirmation between batches after writing has begun. - Validate permission-setting values against their documented enumerations before sending the request.
- Preserve the documentation-level instruction as defense in depth, but do not rely on agent compliance as the only enforcement mechanism.
- Add automated tests proving that each affected script refuses to call the API unless valid operation-bound confirmation is supplied.
- Require an explicit confirmation flag, such as