T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- 言情小说分匠/character-architect.agent.md:5
- Finding
- Delegated Agents Receive Capabilities Beyond Their Documented Responsibilities<![CDATA[ ## Vulnerability Details **File Locations**: - `言情小说分匠/character-architect.agent.md:5` - `言情小说分匠/plot-architect.agent.md:5` - `言情小说分匠/novel-quality-inspector.agent.md:5` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Code The following tool declaration appears in all three affected files: ```yaml tools: [vscode, execute, read, agent, edit, search, web, browser, todo] ``` ### Technical Analysis The affected agents receive shell execution, external network browsing, file editing, and secondary-agent delegation capabilities even though their documented responsibilities primarily involve processing project-local artifacts: - `Character Architect` reads hotspot JSON and creates character design Markdown. - `Plot Architect` reads approved character files and creates a plot blueprint. - `Novel Quality Inspector` reads project artifacts, performs analysis, and writes a review report. The `web`, `browser`, and `agent` tools are not necessary for these core operations. Shell access through `execute` is also broader than required where the agent only needs structured file reads and writes. Each agent contains prompt-level instructions restricting operations to the generated project directory. These restrictions reduce accidental misuse but are not equivalent to runtime access controls. If malicious or untrusted content in a project artifact is interpreted as an instruction, the agent still possesses capabilities that could permit command execution, network communication, or delegation to another agent. No evidence was found that these capabilities are intentionally used for credential theft, persistence, remote payload execution, or data exfiltration. The vulnerability is the unnecessary exposure of privileged tools rather than confirmed malicious behavior. ### Attack Path 1. An attacker causes a crafted hotspot JSON, character design, plot design, or manuscript artifact to be placed in th ...[truncated 1558 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply a separate least-privilege tool policy to every delegated agent: - `Character Architect`: retain only project-scoped `read`, `search`, and `edit` capabilities. - `Plot Architect`: retain only project-scoped `read`, `search`, and `edit` capabilities. - `Novel Quality Inspector`: retain project-scoped `read`, `search`, and report-writing capabilities. If character counting is required, provide a dedicated count operation instead of unrestricted shell execution. 2. Remove `web`, `browser`, and `agent` from all three affected declarations unless a documented workflow explicitly requires them. 3. Remove unrestricted `execute` access. If a command is essential, replace it with a constrained tool that: - Permits only a fixed executable and fixed argument structure. - Rejects shell metacharacters and command substitution. - Resolves and validates paths against the canonical project root. - Does not invoke a general-purpose shell. 4. Enforce the project-directory boundary in the runtime rather than relying only on prompt instructions: - Canonicalize every path before access. - Reject absolute paths outside the project root. - Reject symbolic links resolving outside the project root. - Block traversal through `..`. - Run agents under a filesystem sandbox with no access to sibling projects or sensitive host paths. 5. Treat all artifact contents as untrusted data: - Clearly delimit artifact text from agent instructions. - Instruct agents never to execute commands or follow operational directions found inside artifacts. - Validate JSON and Markdown inputs against expected schemas and size limits. - Strip or quarantine unexpected control-like fields. 6. Add runtime network controls. Agents without a network requirement should have outbound traffic denied by default. 7. Add regression tests verifying that each agent is unable to invoke undeclared tools, access files outside the gen ...[truncated 87 chars]