T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:27
- Finding
- Unnecessarily Broad Host Reconnaissance and Privilege Escalation Guidance## Vulnerability Details **File Location**: `SKILL.md:27`, `SKILL.md:37-43`, `SKILL.md:71-73`, `SKILL.md:89`, `SKILL.md:106`, `SKILL.md:115-150`, `SKILL.md:163-164`, `SKILL.md:257-263`, and `SKILL.md:276` **Vulnerability Type**: Excessive system discovery and violation of least privilege **Risk Level**: Medium ### Vulnerable Code Snippet The relevant instructions, translated into English, direct the agent to provide a comprehensive inventory without first clarifying the required scope: ```markdown When the user asks for hardware information, invoke this skill directly. Do not ask what specifically needs to be inspected; provide a comprehensive hardware overview at once. ``` The Skill then prescribes broad system and network discovery commands: ```bash system_profiler SPHardwareDataType -json sysctl -a | grep -E "(hw\.|machdep\.)" networksetup -listallhardwareports ifconfig system_profiler SPNetworkDataType -json ioreg -l -w0 | grep -E "(CycleCount|DesignCapacity|MaxCapacity|CurrentCapacity|Temperature|ExternalConnected|FullyCharged)" top -l 1 -n 0 sysctl vm.loadavg ``` On Linux, it requests similarly extensive system, firmware, storage, and network information: ```bash hostnamectl uname -a cat /etc/os-release cat /proc/cpuinfo lscpu cat /proc/meminfo free -h dmidecode -t memory lsblk -f fdisk -l smartctl -a /dev/sda df -h ip addr lspci | grep -i net ``` On Windows, it requests full host inventory information: ```powershell Get-ComputerInfo systeminfo ``` The permission-handling guidance, translated into English, states: ```markdown Some commands may require administrator privileges, such as smartctl. If permission problems occur, try using sudo. ``` The final instruction, translated into English, reiterates unconditional comprehensive collection: ```markdown For all of these queries, use this skill to provide a comprehensive hardware inform ...[truncated 3116 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unconditional comprehensive collection with request-specific command mapping. For example, answer a free-space question using only `df`, `diskutil`, or the corresponding Windows storage query. 2. Ask for explicit consent before collecting serial numbers, UUIDs, MAC addresses, network interfaces, connected peripherals, or a complete host inventory. 3. Redact stable identifiers by default. Show serial numbers, UUIDs, and MAC addresses only when explicitly requested. 4. Remove the generic instruction to retry permission failures with `sudo`. 5. For every command that may require elevation, state the exact required field, explain why elevation is necessary, and obtain separate confirmation before execution. 6. Treat inaccessible optional fields as unavailable instead of automatically escalating privileges. 7. Avoid broad commands such as `sysctl -a`, `ifconfig`, `ip addr`, `fdisk -l`, `dmidecode`, `Get-ComputerInfo`, and `systeminfo` unless their full output is directly relevant. 8. Do not collect live process or resource state unless the user asks for performance or utilization information. 9. Add an explicit data-minimization policy requiring the agent to collect and return only fields necessary to satisfy the current request. 10. Separate basic, detailed, and privileged inventory modes, with informed user confirmation required for each increase in scope.