T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:54
- Finding
- Generated agents receive an overprivileged full tool profile<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-64 **Vulnerability Type**: Excessive agent permissions and failure to enforce least privilege **Risk Level**: High ### Vulnerable Code ```json { "id": "agent-id", "name": "agent-id", "agentDir": "/path/to/workspace/agents/agent-id", "model": "model-alias", "tools": { "profile": "full", "deny": ["gateway"] } } ``` The accompanying instructions state that `gateway` should be denied for all agents except the main agent and that `message` should only be denied for pure code agents. They do not establish narrow, role-specific allowlists. ### Technical Analysis The Skill recommends assigning the `full` tool profile to every generated agent and then removing only selected capabilities. This denylist-based model grants specialized agents all capabilities included in the full profile unless each dangerous capability is explicitly identified and denied. A specialized development, research, or design agent generally does not require unrestricted access to shell execution, arbitrary filesystem locations, network services, secrets, messaging, or runtime configuration. Granting these capabilities exceeds the minimum privileges required for the declared multi-agent project-bootstrap workflow. This weakness becomes exploitable when an agent processes attacker-controlled task descriptions, repository content, issue comments, documentation, or other prompt-injection-bearing data. The injected instructions may induce the agent to invoke tools that are unrelated to its legitimate workstream. ### Attack Path 1. An attacker places malicious instructions in content consumed by a generated agent, such as a task description, GitHub issue, source file, or project document. 2. The specialized agent loads and interprets the attacker-controlled content. 3. Because the agent was assigned the `full` tool profile, it has capabilities beyond those necessary for its role. 4. The injected instr ...[truncated 1042 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Replace the `full` profile with explicit role-specific tool allowlists. 1. Start every generated agent with no tools enabled. 2. Add only the capabilities required by that agent's documented responsibilities. 3. Deny shell execution, arbitrary filesystem access, external networking, messaging, secret access, and configuration modification by default. 4. Restrict filesystem access to the agent's workspace and required project directories. 5. Permit outbound network access only to explicitly approved hosts and APIs. 6. Keep `gateway` unavailable to all non-administrative agents. 7. Give messaging capabilities only to agents with a documented communication requirement and restrict approved destinations. 8. Separate credentials by role and issue short-lived, narrowly scoped tokens. 9. Require human approval for privileged operations such as deployment, secret access, repository administration, or agent-configuration changes. 10. Document the required tool set for each role and test that denied tools cannot be invoked. ]]>