T09 · Insecure Skill Coding Practices
Error
- Location
- references/troubleshooting-guide.md:102
- Finding
- Unsafe Privileged Remediation Commands Can Cause Destructive System Changes## Vulnerability Details **File Location**: `references/troubleshooting-guide.md`, lines 102, 219, 223, 268, 319, 371, 648, and 665 **Vulnerability Type**: Unsafe privileged system-administration guidance **Risk Level**: High ### Vulnerable Code ```bash # Lines 102, 319, and 648 sync; echo 3 > /proc/sys/vm/drop_caches ``` ```bash # Line 219 iptables -A INPUT -p tcp --dport port -j ACCEPT ``` ```bash # Line 223 echo "nameserver 8.8.8.8" > /etc/resolv.conf ``` ```bash # Line 268 find /tmp -type f -mtime +7 -delete ``` ```bash # Line 371 fsck /dev/sda1 ``` ```bash # Line 665 echo -1000 > /proc/$(pidof mysql)/oom_score_adj ``` ### Technical Analysis The troubleshooting guide presents commands that directly alter kernel state, firewall policy, DNS configuration, filesystem contents, filesystem metadata, and Out-of-Memory Killer behavior. These operations generally require root or equivalent administrative privileges. Although the Skill contains general safety principles elsewhere, the affected recipes do not place immediate safeguards around these commands. In particular: - Dropping kernel caches can produce substantial I/O load and performance disruption without resolving the underlying memory problem. - Appending an unrestricted firewall acceptance rule can expose a service on every applicable interface and source network. - Overwriting `/etc/resolv.conf` destroys the existing DNS configuration and may conflict with NetworkManager, systemd-resolved, DHCP, or local resolver settings. - Deleting every regular file in `/tmp` older than seven days can remove files still required by applications or users. - Running `fsck` against a mounted or active filesystem can cause corruption or data loss. - Assigning MySQL an OOM adjustment of `-1000` makes it effectively exempt from OOM termination, potentially causing the kernel to terminate other critical processes or destabilize the h ...[truncated 2018 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, command-specific user authorization immediately before every state-changing or privileged operation. 2. Separate diagnosis from remediation. Default to read-only commands and provide proposed changes for review rather than executing them automatically. 3. Replace cache-dropping advice with root-cause analysis using `free`, `vmstat`, `sar`, pressure-stall information, process memory metrics, and application-specific profiling. 4. Before changing firewall policy: - Identify the required interface, source CIDR, protocol, and destination port. - Display the current ruleset. - Prefer a narrowly scoped rule. - Define and test a rollback command. - Confirm that the change will not expose the service publicly. 5. Never overwrite `/etc/resolv.conf` directly without detecting its manager. Back up the existing configuration and modify NetworkManager, systemd-resolved, DHCP, or the platform-specific resolver configuration through its supported interface. 6. Replace direct temporary-file deletion with a preview: ```bash find /tmp -xdev -type f -mtime +7 -print ``` Review ownership and active use before removal, and prefer the operating system's temporary-file management mechanism. 7. Before `fsck`, identify the filesystem and backing device, verify backups, confirm it is unmounted, enter an appropriate maintenance environment, and use non-modifying inspection mode first where supported. 8. Do not set `oom_score_adj` to `-1000` as a generic fix. Correct the memory shortage, apply service-level memory limits, and document the consequences of any OOM policy adjustment. 9. Add local warnings, prerequisite checks, expected effects, verification steps, and tested rollback instructions next to every high-impact command instead of relying only on general safety text elsewhere in the Skill.