T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:104- Finding
External Connector Writes Without Explicit User Authorization
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 104–110
Vulnerability Type: Unauthorized external write operations
Risk Level: MediumVulnerable Code Snippet:
markdown If **Project Tracking** is connected: - Directly synchronize the decomposed user stories to Linear/Jira and create corresponding issues. If **Document Collaboration** is connected: - Publish the complete decomposition document to Notion/Feishu Docs for team sharing.Technical Analysis
The skill directs the agent to create issues and publish complete documents whenever applicable connectors are available. Connector availability is treated as sufficient authorization, with no requirement to obtain explicit user confirmation before performing an external write.
This violates least-privilege and user-consent principles because the skill's primary purpose is requirement decomposition, which can be completed by generating a local Markdown document. Creating records in project-management systems or publishing content to collaboration platforms is a separate side effect that may expose user-supplied requirements, PRD content, business plans, or other confidential information.
The instructions do not require the agent to:
- Ask for confirmation before an external write.
- Identify the target workspace, project, or document location.
- Display the exact content that will be transmitted.
- Remove or redact sensitive information.
- Validate that the connector's scope is appropriate.
- Provide a dry-run or local-only option when a connector exists.
Attack Path
- A user supplies a business requirement, confidential scenario, or complete PRD to the skill.
- The skill extracts and restructures the supplied information.
- A project-tracking or document-collaboration connector is available in the agent environment.
- The skill follows its connector instructions and creates Linear/Jira issues or publishes the co ...[truncated 1095 chars]
- Remediation
View remediation
Remediation Suggestions
- Make local Markdown generation the default behavior, regardless of connector availability.
- Require explicit user confirmation immediately before each external write operation.
- Present the connector, workspace, project, destination, and exact outbound payload before requesting approval.
- Allow the user to edit or redact the payload before transmission.
- Minimize transmitted data and exclude credentials, personal data, internal identifiers, and confidential PRD sections unless specifically approved.
- Validate connector scopes and reject destinations that cannot be confirmed.
- Separate content generation from publication so that publication is an optional, independently authorized action.
- Record the destination and operation result without storing sensitive document content unnecessarily.
- Replace the affected instructions with wording such as:
markdown If a supported connector is available, generate a local preview first. Do not create issues or publish documents unless the user explicitly confirms the exact destination and payload.