T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:4
- Finding
- Unrestricted Shell Access Granted to an Incomplete Externally Sourced Skill## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive shell permissions and violation of least privilege **Risk Level**: High **Relevant Code**: ```yaml --- name: content-creation-publisher description: content-creation-publisher - 从云端仓库同步的技能 allowed-tools: Bash(*) --- ``` The broader context at lines 18–21 confirms that the reviewed package is incomplete and directs the user or agent to retrieve unspecified files and instructions externally: ```markdown ## 说明 请访问云端仓库获取完整的技能文件和使用说明。 ``` ### Technical Analysis The `allowed-tools: Bash(*)` declaration grants unrestricted access to the Bash execution interface. No local scripts or implementation are present to justify this broad capability; the project contains only a placeholder `SKILL.md`. The skill also states that its complete files and operating instructions must be obtained from an external repository. This configuration breaks the principle of least privilege. Because command names, arguments, paths, and operations are not constrained, future or externally retrieved instructions could use Bash to perform arbitrary operations under the operating-system identity of the hosting agent. The locally audited package therefore does not provide an enforceable boundary around the commands that the eventual implementation may execute. The reviewed file does not itself contain a command that downloads or executes a remote payload. Consequently, external compromise is a prerequisite for the exploitation path described below rather than a confirmed remote-execution action in the current package. ### Attack Path 1. The incomplete skill is installed or loaded with `Bash(*)` enabled. 2. A user or agent follows the instruction in `SKILL.md` to obtain the complete skill files and usage instructions from the referenced external repository. 3. The external repository, its upstream account, or subsequently supplied instructions ar ...[truncated 1065 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash(*)` until the complete implementation has been packaged and independently reviewed. 2. Replace unrestricted Bash access with an explicit allowlist of the minimum commands required for the skill's legitimate content-publishing workflow. 3. Restrict permitted arguments, executable paths, working directories, environment variables, filesystem locations, and network destinations where the platform supports such controls. 4. Include the complete implementation in the audited package rather than relying on runtime retrieval of unspecified instructions. 5. If external artifacts are unavoidable, pin them to a reviewed immutable commit or release and verify a cryptographic checksum or signature before use. 6. Do not automatically execute retrieved files. Review them before activation and require explicit authorization for security-sensitive commands. 7. Run the skill in a sandboxed, unprivileged environment with minimal filesystem access, no unnecessary credentials, and deny-by-default outbound networking. 8. Add security tests that reject undeclared commands and verify that the skill cannot access resources outside its documented operational scope.