T09 · Insecure Skill Coding Practices
Error
- Location
references/capabilities.md:37- Finding
Irreversible MCP Snapshot Deletion Lacks an Enforced Confirmation Gate
- Content
View full analysis
Vulnerability Details
File Location:
references/capabilities.md:37-44
Vulnerability Type: Destructive operation without server-enforced confirmation
Risk Level: HighRelevant excerpts:
markdown ## Write tools (6) | Tool | Risk | REST (modelled) | Undo / safety | |------|------|----------------|---------------| | `pool_scrub_start` | medium | `POST /pool/scrub/run` | captures prior scan state; no undo (non-destructive); `dry_run` | | `dataset_create` | medium | `POST /pool/dataset` | no undo (deletion out of scope); `dry_run` | | `snapshot_create` | medium | `POST /zfs/snapshot` | records inverse `snapshot_delete` undo descriptor; `dry_run` | | `snapshot_delete` | **high** | `DELETE /zfs/snapshot/id/{id}` | captures BEFORE state; IRREVERSIBLE, no undo; CLI double-confirm + `dry_run` | | `service_restart` | medium | `POST /service/restart` | captures prior state; no undo; refuses a name absent from `service_list`, and refuses `ssh` without `confirm=True` (out-of-band recovery path); guards also fire under `dry_run`; CLI double-confirm | | `undo_apply` | medium | governance store | executes a recorded inverse; itself governed; single-use; supports dry-run |The absence of an authorization gate is further stated in
SKILL.md:208-220:markdown The skill delivers reads and writes and records them; it does **not** decide whether a write is permitted. That is your agent's judgement, or the permission of the account you connect it with (scope the TrueNAS API key to a limited-privilege account and writes then fail at the appliance). There is no read-only switch, policy file, or approval gate. - Writes support `--dry-run` / `dry_run=True` and double confirmation at the CLI; CLI writes execute through the same governed tools, so they are audited + undo-recorded.Technical Analysis
The Skill exposes
snapshot_deleteas an MCP write tool backed by an irreversible TrueNAS sna ...[truncated 2402 chars]- Remediation
View remediation
Remediation Suggestions
- Enforce confirmation inside the MCP/server implementation rather than only in the CLI wrapper.
- Make irreversible operations default to dry-run and require an explicit execution transition.
- Have the dry-run response issue a short-lived, single-use confirmation token bound to the target, snapshot identifier, operation, authenticated caller, and previewed request.
- Require that token for the subsequent deletion and reject direct deletion calls without it.
- Add a configurable read-only mode and an operation allowlist enforced by the server for MCP and CLI entry points alike.
- Require a separate high-risk approval control for irreversible operations, independent of optional audit annotations.
- Preserve least privilege by instructing operators to use a TrueNAS API account that can access only the datasets and operations required for the current workflow.
- Add tests proving that MCP calls cannot delete snapshots without completing the enforced preview and confirmation sequence.