T09 · Insecure Skill Coding Practices
Error
- Location
- computer_use.py:235
- Finding
- Documented sandbox and authorization controls are not enforced<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:427-451`, `computer_use.py:235-243`, `computer_use_pro.py:529-543`, `computer_use_pro.py:674-679` **Vulnerability Type**: Missing authorization and path restriction enforcement **Risk Level**: High The documentation describes confirmation requirements, forbidden paths, sandboxing, and application allowlisting: ```yaml security: # Operations requiring confirmation require_confirmation: - delete - kill - sudo # Forbidden directories forbidden_paths: - /etc - /usr/bin - ~/.ssh # Allowed applications allowed_apps: - google-chrome - code - terminal - nautilus ``` However, the base implementation performs recursive deletion without consulting this configuration or requesting confirmation: ```python def delete(self, path: str): """Delete a file or directory.""" import shutil path = os.path.expanduser(path) if os.path.isdir(path): shutil.rmtree(path) else: os.remove(path) ``` The Pro implementation includes an optional prompt, but callers can explicitly disable it: ```python def delete(self, path: str, confirm: bool = True): """Delete a file or directory with optional confirmation.""" import shutil path = os.path.expanduser(path) if confirm: response = input(f"确定要删除 {path} 吗? (y/N): ") if response.lower() != 'y': print("取消删除") return if os.path.isdir(path): shutil.rmtree(path) else: os.remove(path) ``` Process termination is similarly unrestricted: ```python def kill_process(self, pid: int, force: bool = False): """Terminate a process.""" if force: subprocess.run(["kill", "-9", str(pid)], check=True) else: subprocess.run(["kill", str(pid)], check=True) ``` ### Technical Analysis The security configuration shown in the documentation is not loaded or enforced by either Python implementation. There is n ...[truncated 2152 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Implement a centralized security-policy component and require every destructive, launch, and process-control method to use it. 2. Load the documented configuration from a trusted location and fail closed if it is missing, malformed, or inaccessible. 3. Resolve paths with `Path.resolve(strict=False)` or `os.path.realpath()` before authorization checks. 4. Enforce an explicit allowlist of permitted working directories. Do not rely exclusively on a denylist. 5. Reject paths outside the allowlist after resolving symbolic links and parent-directory traversal. 6. Make approval non-bypassable for destructive operations. A public `confirm=False` parameter must not disable a security decision. 7. Bind approval to the exact canonical path, operation, and invocation so that approval cannot be reused for another target. 8. Restrict process termination to child processes recorded as having been launched by this skill. 9. Validate application names against an explicit allowlist and prefer absolute executable paths. 10. Add automated tests proving that sensitive paths, symlink escapes, unauthorized applications, and unrelated PIDs are rejected. 11. Correct the documentation so it does not claim sandboxing or enforcement until those controls are actually implemented. ]]>