T09 · Insecure Skill Coding Practices
- Location
SKILL.md:92- Finding
Unsafe DOM Targeting Can Trigger Unintended Product Distribution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 92–123
Vulnerability Type: Ambiguous DOM selection for transactional actions
Risk Level: MediumVulnerable Code
javascript // Find and click the "Distribute Now" button const distributeBtn = [...document.querySelectorAll('button, div[role="button"]')].find(el => el.textContent && el.textContent.includes('立即铺货') && el.offsetParent !== null ); if(distributeBtn) { distributeBtn.scrollIntoView({ behavior: 'smooth', block: 'center' }); distributeBtn.click(); } else { console.error('未找到"立即铺货"按钮'); }javascript // Find and click the target shop (replace shop name) const targetShop = "kyeshop小店"; // Obtain from user input const shopElements = [...document.querySelectorAll('*')].filter(el => el.textContent && el.textContent.includes(targetShop) && el.offsetParent !== null ); if(shopElements.length > 0) { shopElements[shopElements.length - 1].click(); } // Find and click the confirmation button const confirmBtn = [...document.querySelectorAll('*')].find(el => el.textContent && el.textContent.includes('立即铺货') && el.offsetParent !== null ); if(confirmBtn) confirmBtn.click();Technical Analysis
The automation identifies consequential controls using broad, partial text matching. In particular,
querySelectorAll('*')examines every element in the document, including noninteractive containers, nested descendants, duplicated text, and marketplace-controlled content. It then chooses the last shop-name match and the first visible element containing the distribution label.Visibility through
offsetParent !== nulldoes not establish that an element is the intended control. The code also does not require an exact normalized text match, a unique match, an expected dialog ancestor, or a verified button role. Before confirmation, it does not verify the selected shop, selected product count, or final transaction summary.This creates an exploitable confused-control c ...[truncated 1575 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace global
querySelectorAll('*')searches with stable selectors scoped to the expected modal, form, or table. - Restrict candidates to appropriate interactive elements, such as
button, elements with a verified button role, or documented application controls. - Compare exact normalized text rather than using unrestricted substring matching.
- Require exactly one valid match. Abort and report an error when no match or multiple matches are found.
- Identify shops using stable application identifiers rather than display-name text where possible.
- Verify after selection that the displayed shop identifier or exact shop name equals the user-requested destination.
- Before the final submission, validate the selected product count, destination shop, and operation type against an expected summary.
- Require explicit user confirmation immediately before the irreversible distribution action.
- After submission, inspect a structured success response or verified status element rather than inferring success merely from a click.
- Add safe failure behavior: do not proceed to confirmation if any earlier selection or verification step is ambiguous.
- Replace global