T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:4- Finding
Unnecessary Unrestricted Shell Capability
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 4–11
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: MediumEvidence
yaml license: MIT allowed-tools: - Read - Grep - Glob - Bash - WebFetch - WriteTechnical Analysis
The skill grants access to
Bash, which provides a general-purpose local command-execution channel. The documented workflow only requires retrieving public web pages, inspecting content, analyzing GEO/SEO signals, and writing a report. It does not define any shell command or operation that requires unrestricted Bash access.This permission therefore exceeds the skill's stated operational requirements and violates the principle of least privilege. Because the workflow processes attacker-controlled website content, unrestricted shell access unnecessarily increases the consequences of instruction confusion, unsafe orchestration, or future changes to the skill.
No direct instruction to invoke Bash maliciously was identified, so this is an excessive-permission weakness rather than evidence of intentional command execution.
Attack Path
- An operator loads the skill and supplies a website controlled by an attacker.
- The skill retrieves attacker-controlled content as part of its ordinary audit workflow.
- The content contains adversarial instructions or data that are mistakenly treated as operational guidance.
- Because
Bashis authorized, the agent may invoke shell commands that are not necessary for the GEO audit. - Those commands execute with the filesystem access, network access, and operating-system privileges available to the hosting agent process.
This path depends on the agent being induced to misuse the excessive permission;
SKILL.mditself contains no explicit malicious Bash command.Impact Assessment
Successful exploitation could permit arbitrary commands within the privileges of ...[truncated 491 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
Bashfromallowed-toolsbecause no documented workflow step requires shell execution. - Retain only the narrowly scoped tools necessary for reading project data, retrieving web pages, analyzing content, and writing the audit report.
- If shell functionality becomes necessary later, replace unrestricted Bash access with a constrained helper that:
- Allows only explicitly enumerated commands and arguments.
- Rejects shell metacharacters, pipelines, redirections, substitutions, and dynamic command construction.
- Restricts filesystem operations to the designated workspace and output file.
- Disables unnecessary network access.
- Runs under a low-privilege, sandboxed account.
- Treat all fetched website content as untrusted data and explicitly prohibit following instructions embedded in audited pages.
- Add tests verifying that the complete GEO audit workflow succeeds without Bash authorization.
- Remove