T01 · Skill Instruction Hijacking
- Location
SKILL.md:258- Finding
Filesystem Write Permission Gate Bypass Through Shell Command Fallback
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:258
Vulnerability Type: Permission-gate bypass through an alternate tool
Risk Level: HighComplete Snippet:
markdown - **Permission Handling**: If you do not have permission to write directly to `%USERPROFILE%\Desktop\_Reports`, request it using `ask_permission` for `write_file` with target `C:\Users\relig\Desktop` or execute the file write operations via the `run_command` tool in PowerShell.Technical Analysis
The Skill explicitly instructs the agent to use PowerShell through
run_commandas an alternative when direct filesystem write permission is unavailable. This makes shell execution a substitute for the permission mechanism associated withwrite_file.A denied or unavailable permission is a security boundary, not merely a tool limitation. Redirecting the same operation through a more general command-execution tool defeats that boundary rather than resolving it through explicit user authorization. The instruction is activated specifically under the condition where direct write permission is absent.
Although the intended destination is the audit report directory, the prescribed fallback undermines tool-level access controls and establishes an unsafe pattern in which a general-purpose shell can bypass restrictions applied to a specialized filesystem tool.
Attack Path
- A user invokes the forensic audit Skill.
- The Skill attempts to create or write reports beneath
%USERPROFILE%\Desktop\_Reports. - The agent determines that it lacks permission to write there using the designated file-writing mechanism.
- Instead of stopping or requiring a successful explicit permission grant, the Skill permits the agent to invoke PowerShell through
run_command. - PowerShell performs the filesystem write outside the denied or unavailable
write_fileauthorization path. - The operation therefore proceeds without the permission gate intended for direct file writes.
Impact
...[truncated 573 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
run_commandand PowerShell fallback for situations where direct write permission is absent. - Require the agent to use the platform’s explicit permission mechanism before creating or modifying files outside an already authorized location.
- If permission is denied, unavailable, or cannot be verified, terminate report generation safely and inform the user that no files were written.
- Permit an alternative output directory only when the user explicitly selects and authorizes it.
- Clarify that authorization failures must never be bypassed by switching to a more privileged or general-purpose tool.
- Constrain report writes to a canonicalized, user-approved directory and reject paths that resolve outside that directory.
A safe replacement would be:
markdown - **Permission Handling**: If write permission for the report directory is unavailable, request explicit permission using the platform permission mechanism. If permission is not granted, stop without writing files and ask the user to select an authorized output directory. Do not use shell commands or alternate tools to bypass a denied permission.- Remove the