T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:63
- Finding
- Unsafe Destructive File and Process Management Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 63, 119, 299, 352, and 362 **Vulnerability Type**: Unsafe destructive shell command guidance **Risk Level**: High ### Vulnerable Code `SKILL.md:63` ```bash rm -rf directory/ # Delete directory ``` `SKILL.md:119` ```bash kill -9 PID # Force termination ``` `SKILL.md:299` ```bash find . -name "*.log" | xargs rm # Batch deletion ``` `SKILL.md:352` ```bash kill -9 $(lsof -t -i:8080) ``` `SKILL.md:362` ```bash sudo rm -rf /var/log/*.log ``` ### Technical Analysis The Skill provides destructive shell commands without adequate validation, scoping, preview, confirmation, or error handling: - `rm -rf directory/` recursively removes a target without confirmation. If the path is incorrect, empty after variable substitution in generated variants, or unexpectedly resolved, the command can cause extensive data loss. - `find . -name "*.log" | xargs rm` does not use null-delimited filenames or an option terminator. Filenames containing whitespace, newlines, or leading hyphens can be parsed incorrectly. A leading-hyphen filename may be interpreted as an `rm` option. - `sudo rm -rf /var/log/*.log` performs privileged wildcard deletion of system logs. This can remove active diagnostic or security records, interfere with services, and destroy evidence needed for incident investigation. - `kill -9` immediately terminates processes without allowing graceful shutdown, cleanup, lock release, or state persistence. - `kill -9 $(lsof -t -i:8080)` does not explicitly validate that the returned values are expected numeric process identifiers belonging to the intended application. It can terminate multiple processes associated with the port and may disrupt unrelated services. These commands are presented as reusable operational guidance and may therefore be copied directly or reproduced by an agent in ge ...[truncated 2516 chars]
- Remediation
- ## Remediation Suggestions 1. Replace broad recursive deletion examples with scoped, defensive alternatives. Require users to inspect the target before deletion: ```bash target="/expected/path/directory" printf 'Target: %s\n' "$target" find "$target" -maxdepth 1 -print rm -rI -- "$target" ``` 2. Use null-delimited pathname handling and an explicit option terminator for batch operations: ```bash find . -type f -name '*.log' -print0 | xargs -0 --no-run-if-empty rm -- ``` Alternatively: ```bash find . -type f -name '*.log' -exec rm -- {} + ``` Add a preview stage using `-print` before recommending deletion. 3. Do not recommend deleting system logs using `sudo rm -rf`. Use the system's log-management facilities, such as `logrotate` or bounded journal cleanup: ```bash sudo journalctl --vacuum-time=7d ``` Any cleanup guidance should preserve active logs, comply with retention requirements, and identify the exact files affected before modification. 4. Prefer graceful process termination and verify process identity before escalation: ```bash pids=$(lsof -t -iTCP:8080 -sTCP:LISTEN) if [ -n "$pids" ]; then ps -fp $pids kill $pids fi ``` Recommend `SIGKILL` only as a final recovery step after graceful termination fails and the operator verifies each PID. 5. Add explicit safeguards to generated scripts, including: - Quoted path and variable expansions. - Nonempty and expected-prefix checks for paths. - Numeric validation for process identifiers. - Dry-run or preview modes. - Interactive confirmation for destructive operations. - Least-privilege execution. - Backups or recovery instructions before deletion.