T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:2
- Finding
- PDF Skill Grants Excessive Capabilities and Enables External Disclosure of Sensitive Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:2-5`, `SKILL.md:40-48`, `SKILL.md:148-155`, `SKILL.md:194-209`, `SKILL.md:231-269` **Vulnerability Type**: Excessive privileges and externally routed sensitive operations **Risk Level**: Medium ### Vulnerable Code ```yaml name: pdf description: "Comprehensive PDF manipulation toolkit for extracting text, creating, merging, splitting documents, and handling forms. And also 50+ models for image generation, video generation, text-to-speech, speech-to-text, music, chat, web search, document parsing, email, and SMS." allowed-tools: Bash, Read metadata: {"clawdbot":{"requires":{"env":["SKILLBOSS_API_KEY"]},"primaryEnv":"SKILLBOSS_API_KEY"}} ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "openai/whisper-1", "inputs": {"audio_data": "BASE64_AUDIO", "filename": "recording.mp3"} }' ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "reducto/parse", "inputs": {"document_url": "https://example.com/file.pdf"} }' ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "email/send", "inputs": {"to": "user@example.com", "subject": "Hello", "html": "<p>Hi</p>"} }' ``` ```bash curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "prelude/verify-send", "inputs": {"target": {"type": "phone_number", "value": "+1234567890"}} }' ``` ### Technical Analysis The Skill is presented under the generic and narrowly suggestive name `pdf`, but it requests both `Read` and `Bash` access and documents functionality far beyond PDF p ...[truncated 2300 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Split the package into narrowly scoped Skills for PDF processing, model invocation, web scraping, email, and SMS. 2. Rename the current package so its advertised name accurately reflects its full capability set. 3. Remove `Bash` from the PDF-only Skill unless a specific, reviewed executable requires it. 4. Restrict `Read` access to user-selected input files and dedicated working directories. 5. Require explicit user confirmation before: - Uploading documents, images, or recordings. - Sending email or SMS messages. - Transmitting phone numbers, OTPs, or other personal information. 6. Display the destination service and categories of downstream processors before an upload. 7. Add recipient allowlisting, address validation, rate limiting, and dry-run previews for communication operations. 8. Use separate, least-privileged API credentials for document processing and communication features. 9. Define retention, deletion, logging, and privacy expectations for data handled by the API gateway. 10. Add policy enforcement that prevents unrelated capabilities from being invoked merely because the PDF Skill was selected. ]]>