T09 · Insecure Skill Coding Practices
- Location
scripts/mf_client.py:435- Finding
Declared Content-Safety and Destructive-Action Controls Are Not Enforced
- Content
View full analysis
Vulnerability Details
File Location:
scripts/mf_client.py, lines 435–445
Vulnerability Type: Unvalidated privileged content submission and unconfirmed destructive operation
Risk Level: MediumVulnerable Code
python def cmd_save_article(json_file): with open(json_file) as f: article_data = json.load(f) r = api_call(f"{CMS_BASE}/article/save", method="POST", data=article_data) pjson(r) if r.get("code") == 200: print("\nArticle saved successfully!") def cmd_delete_article(aid): pjson(api_call(f"{CMS_BASE}/article/remove", method="POST", data={"id": int(aid)}))Technical Analysis
cmd_save_articletreats the supplied JSON file as trusted and forwards its complete contents to the authenticated CMS API. It does not validate the permitted fields, sanitize HTML content, force draft status, create a backup, or require a separate publication confirmation.This behavior conflicts with the safety requirements declared in
SKILL.md, which require sanitizing user-provided HTML, previewing content as a draft before publication, and backing up content before editing. If the API accepts a payload containing active HTML andstatus: 1, the client can submit that content directly for publication. Whether active content is ultimately exploitable depends on server-side CMS validation and sanitization, which the client cannot guarantee.cmd_delete_articlealso immediately calls the permanent removal endpoint using the supplied article ID. It does not ask for confirmation, retrieve the target for review, create a backup, or prefer a reversible disable operation as required by the Skill's documented safety rules.Because both operations use the loaded
X-Tokenand optionaladmin-token, any resulting action executes with the authenticated CMS user's existing privileges.Attack Path
A content-submission attack can proceed as follows:
- An attacker, unt ...[truncated 2058 chars]
- Remediation
View remediation
Remediation Suggestions
- Define and enforce an allowlisted schema for article payloads. Reject unknown fields, invalid identifiers, unexpected value types, and unsupported publication states.
- Sanitize article HTML with a maintained allowlist-based HTML sanitizer. Permit only required elements, attributes, and URL schemes.
- Force new and modified articles to
status: 0by default. Implement publication as a separate command that requires explicit confirmation. - Retrieve and display the existing article before modification or deletion so the operator can verify the target.
- Export or save a timestamped backup of the current article before changing or removing it.
- Require explicit interactive confirmation for destructive operations, including the article ID and title in the prompt.
- Prefer a reversible disable or soft-delete operation where supported. Reserve permanent removal for a separately named command with stronger confirmation.
- Consider a non-interactive safety flag such as
--confirm-delete ARTICLE_IDfor automation, ensuring that destructive behavior cannot occur merely from an ambiguous positional argument. - Add automated tests verifying that unsafe HTML is rejected or sanitized, publication is draft-first, and deletion cannot proceed without confirmation.