T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:4- Finding
Unrestricted Bash Permission Violates Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 4
Vulnerability Type: Excessive tool permissions
Risk Level: MediumVulnerable Code
yaml allowed-tools: Bash(*)Technical Analysis
The skill declares unrestricted access to the Bash tool through the wildcard permission
Bash(*). However, the package contains only a placeholder document and defines no local operation that legitimately requires shell execution.This permission is broader than the skill's documented functionality and violates the principle of least privilege. If the agent runtime grants the declared capability, instructions added later or obtained from the referenced external repository could invoke arbitrary shell commands without being constrained to a narrowly defined command set.
The external repository reference does not itself download or execute content, so remote payload retrieval and execution is not confirmed by the audited package.
Attack Path
- A user loads or enables the skill.
- The agent runtime grants the declared wildcard Bash capability.
- Untrusted, externally obtained, or subsequently modified skill instructions direct the agent to invoke Bash.
- Because the permission has no command-level restriction, the instructions can attempt arbitrary commands under the privileges and sandbox boundaries of the agent process.
- Those commands may access or alter resources available to that process.
Impact Assessment
Successful exploitation could permit arbitrary command execution with the effective privileges of the agent process. Depending on runtime sandboxing, operating-system permissions, and approval controls, the accessible scope could include project files, environment variables, local credentials, network resources, and other files writable by the executing account.
The audited file contains no command that actively exercises this permission. Therefore, the finding represents an excessi ...[truncated 91 chars]
- Remediation
View remediation
Remediation Suggestions
Remove
allowed-tools: Bash(*)because the current placeholder functionality does not require shell access.If executable functionality is added later:
- Include all required implementation files in the reviewed package rather than relying on unspecified external instructions.
- Grant only the exact tools and narrowly scoped commands required for the documented task.
- Avoid wildcard shell permissions and require explicit approval for commands involving the network, credentials, package installation, or destructive file operations.
- Validate and safely quote all command arguments derived from users or external data.
- Run commands in a restricted sandbox using a low-privilege account with minimal filesystem and network access.
- Re-audit the complete downloaded implementation before enabling any execution permission.