SW-SKL-006: Destructive command without a confirmation step
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI10 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | AC-6 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
The rule reads the script files of the package and the fenced code blocks of its Markdown files, joining continued lines as the shell does. A command is destructive when it holds a recursive forced delete (rm -rf in any flag order), git reset --hard, git clean with force, drop table, drop database or drop schema, truncate table, kubectl delete, terraform destroy, gsutil rm -r, mkfs, dd if=, shred, chmod -R 777, a fork bomb, a git push with force, an aws s3 rm or rb with the recursive or force option, or an az delete.
Such a command is excused when it, or one of the three commands before it, contains confirm, ask, approval, approve, "only if the user", "after the user", "prompt the user" or --dry-run. Otherwise it is one finding at its first line, with the command as evidence. Only scripts and code blocks are read, so a sentence in prose that describes such a command is not matched.
Why it matters
A script that destroys data without a check turns a wrong guess by the agent into a loss that cannot be undone: a delete that runs in the wrong directory, a reset that drops uncommitted work, a destroy against the wrong environment. Each of those commands is ordinary in the right place, and the rule is about the missing pause. The scanner maps this rule to OWASP ASI10, Rogue Agents, and to NIST SP 800-53 control AC-6, Least Privilege.
Example
This script changes into the directory it is given and then removes a folder with a recursive forced delete, with no confirmation in the commands before it:
.claude/skills/cache-cleaner/SKILL.md
---
name: cache-cleaner
description: Cleans the build output of a project.
license: MIT
version: 1.0.0
---
# Cache cleaner
Run scripts/clean.sh from the project root..claude/skills/cache-cleaner/scripts/clean.sh
#!/bin/sh
cd "$1"
rm -rf ./build-outputThe finding is on the line with the delete.
How to fix
Add a step that shows what will be removed and asks the user to confirm before the command runs, or run the command with its dry-run option first and print the result. A comment such as "ask the user first" above the command is enough to satisfy the rule, but a real prompt is what protects the user.
Where you can, narrow the command to a path the script has just created, and refuse an empty or root path.
If it is a false positive
A cleanup script that deletes only a temporary folder it made itself is safe and still matches. Accept the finding with a note that names the folder, or add the confirmation line, which costs nothing.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.