| §34 |
Shell Injection via Agent-Constructed Commands |
Critical |
1/3 |
2026-08-06 |
acme%2Fwidgets was accepted and sent to the API; ../../etc/test reached filesystem handling and produced only a prose path error, with no structured validation or correction suggestion |
| §37 |
REPL / Interactive Mode Accidental Triggering |
Critical |
3/3 |
2026-08-06 |
No REPL or shell subcommand exists; cube shell was rejected immediately by argument parsing with exit 2 and cannot enter an interactive loop |
| §42 |
Debug / Trace Mode Secret Leakage |
Critical |
1/3 |
2026-08-06 |
--debug is unsupported and the parser did not echo the fake token, but the documented --token option exposed the credential verbatim in the process table; no safe trace mode or sensitive schema exists |
| §43 |
Tool Output Result Size Unboundedness |
Critical |
0/3 |
2026-08-06 |
A 70 KiB API field was emitted in full as 71,748 bytes; there is no output bound, truncation metadata, or pre-flight size facility |
| §45 |
Headless Authentication / OAuth Browser Flow Blocking |
Critical |
1/3 |
2026-08-06 |
An authenticated command with no credentials exited immediately, but even --json produced only a prose stderr error with exit 1 and no AUTH_REQUIRED code or auth_methods array |
| §50 |
Stdin Consumption Deadlock |
Critical |
1/3 |
2026-08-06 |
-d - with closed stdin failed immediately rather than hanging, but returned a generic prose JSON-parse error with exit 1 instead of a structured STDIN_REQUIRED error and hint |
| §53 |
Credential Expiry Mid-Session |
Critical |
1/3 |
2026-08-06 |
A mocked 401 was described as “session expired” with a re-login hint, but only in prose; there was no structured expiry code, timestamp, or reauthentication field, and exit 1 was generic |
| §60 |
OS Output Buffer Deadlock |
Critical |
0/3 |
2026-08-06 |
The server flushed the first JSON fragment immediately, yet the CLI emitted no stdout after one second and released the entire response only after the server completed; no heartbeat or incremental JSON lines were present |
| §61 |
Bidirectional Pipe Payload Deadlock |
Critical |
1/3 |
2026-08-06 |
A 70,014-byte stdin JSON object was accepted and a 71,727-byte response was emitted successfully, but no stdin size limit or STDIN_TOO_LARGE signal exists; -d @file.json is the documented file alternative |
| §62 |
$EDITOR and $VISUAL Trap |
Critical |
3/3 |
2026-08-06 |
Cube exposes no editor-requiring command; cube edit with EDITOR=true and VISUAL=true was rejected immediately with exit 2, so neither variable can trigger an editor trap |
| §64 |
Headless Display and GUI Launch Blocking |
Critical |
0/3 |
2026-08-06 |
cube login invoked the platform browser command despite CI=true, closed stdin, isolated config, and --json; it then remained in the OAuth polling loop until manually cancelled, and the URL was ANSI-styled prose rather than JSON |
| §71 |
Non-Interactive Installation Absence |
Critical |
2/3 |
2026-08-06 |
The official README documents a non-interactive installer; two isolated runs both exited 0 and cube --version returned Cube CLI 1.7.16, but no AGENTS.md documents the agent install and verification contract |
| §10 |
Interactivity & TTY Requirements |
Critical |
0/3 |
2026-08-06 |
With closed stdin and CI=true, cube login --url ... launched the browser path and was still polling with no new output after the five-second check window; it required manual cancellation |
| §11 |
Timeouts & Hanging Processes |
Critical |
0/3 |
2026-08-06 |
--timeout 2 is unsupported; a request whose server withheld its response was still active with no output after three seconds and required manual cancellation, with no structured timeout or partial progress |
| §12 |
Idempotency & Safe Retries |
Critical |
0/3 |
2026-08-06 |
The same mutating request was attempted twice with one idempotency key; both invocations rejected --idempotency-key at parse time, so Cube provides no CLI-level retry identity, noop effect, or universal dry-run |
| §13 |
Partial Failure & Atomicity |
Critical |
1/3 |
2026-08-06 |
A deploy transaction failed deliberately at file upload after hashing and transaction start; stderr named the file and failing endpoint, but --json still returned no partial, completed-step list, rollback state, or resume token |
| §23 |
Side Effects & Destructive Operations |
Critical |
0/3 |
2026-08-06 |
--dry-run was rejected, while the same DELETE against the local mock executed without confirmation and returned a deletion result; no danger declaration, preview, or explicit destructive confirmation exists |
| §24 |
Authentication & Secret Handling |
Critical |
1/3 |
2026-08-06 |
A fake credential supplied through CUBE_API_KEY was not echoed, but Cube also accepts secrets through --token/login --api-key and maps authentication failure to generic exit 1 rather than a defined auth code |
| §25 |
Prompt Injection via Output |
Critical |
0/3 |
2026-08-06 |
User-controlled API text containing an instruction-like payload was returned as an ordinary raw JSON message field, with no response envelope, trust annotation, content type, or separation from CLI metadata |
| §74 |
Credential Scope Declaration Absence |
Critical |
0/3 |
2026-08-06 |
Neither --schema nor check-permissions exists, and official CLI docs do not map command groups to minimum API-key/OAuth scopes; agents cannot compare required, active, or excessive privileges |
| §1 |
Exit Codes & Status Signaling |
Critical |
1/3 |
2026-08-06 |
Missing arguments used clap exit 2, but both a 404 resource and a connection failure exited 1; codes are not documented and no JSON error body embeds the code |
| §2 |
Output Format & Parseability |
Critical |
1/3 |
2026-08-06 |
Global --json produced valid raw success JSON, but without ok/data; a 404 under the same flag emitted prose only on stderr, so the output contract changes between success and failure |