T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/orchestrate.py:153
- Finding
- Cross-Skill Inventory Modification with Fabricated Persistent Data## Vulnerability Details **File Location**: `scripts/orchestrate.py`, lines 153-158 **Vulnerability Type**: Cross-skill state modification and least-privilege violation **Risk Level**: Medium **Vulnerable Code**: ```python # Assume stock.csv in lab-inventory stock_path = os.path.join(LAB_INVENTORY_DIR, 'stock.csv') # Create dummy if not exists? For testing. if not os.path.exists(stock_path): with open(stock_path, 'w') as f: f.write('reagent,quantity,unit,price\nacid,5,g,10.0\n') ``` ### Technical Analysis When stock checking is enabled and `stock.csv` does not exist, the orchestrator creates a fabricated inventory file inside the separate `lab-inventory` Skill directory. This crosses the expected boundary between consuming another Skill and modifying its persistent data. The behavior is not necessary to perform a read-only inventory check and is not disclosed in `SKILL.md`. The generated record is treated as real stock even though it is explicitly dummy test data. Because the file remains after execution, it can affect later runs and other components that share the same inventory directory. Exploitation requires the process to have write access to the sibling Skill directory and the inventory file to be absent. No privilege elevation at the operating-system level occurs; the issue is an abuse of already granted filesystem access beyond the orchestrator's legitimate task requirements. ### Attack Path 1. An attacker or user invokes the Skill with a query containing `check stock`. 2. The sibling `lab-inventory/stock.csv` file is absent, removed, or renamed. 3. `check_inventory()` writes a new persistent `stock.csv` into the sibling Skill directory. 4. The new file falsely records five grams of `acid` as available inventory. 5. The current run or later inventory operations consume the fabricated record. 6. Candidate feasibility, reagent availability, and cost calculations may consequently be based on ...[truncated 696 chars]
- Remediation
- ## Remediation Suggestions - Remove all logic that creates dummy inventory in the sibling Skill directory. - Treat a missing inventory file as an explicit configuration or operational error. - Keep test fixtures in test-only directories and ensure production code cannot activate them. - Require an explicitly configured inventory path rather than deriving and modifying another Skill's installation directory. - Open the configured inventory in read-only mode for stock checks. - If generated state is genuinely required, place it in an isolated per-run workspace with restrictive permissions and delete it after use. - Validate the inventory schema and provenance before using records for availability or cost calculations. - Separate application code, immutable Skill assets, and mutable operational data through filesystem permissions.