T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:341
- Finding
- Unscoped Discovery of Authentication Tokens## Vulnerability Details **File Location**: `SKILL.md:341-346` **Vulnerability Type**: Credential discovery beyond defined least-privilege boundaries **Risk Level**: Medium **Relevant excerpt translated into English from the original documentation:** ```markdown **Type**: TECH-001 (API usage error) **Cause**: GitHub token was not found **Resolution**: Search multiple locations for the token **Prevention**: 1. Verify that the token is usable before publishing 2. Establish a standard token storage location ``` Supporting references also occur in `ERROR_LOG.md:43-60`, where the documented solution explicitly recommends searching multiple locations for token files and establishing a multi-location token-search mechanism. ### Technical Analysis The Skill recommends searching multiple filesystem locations for authentication tokens but does not establish: - An allowlist of permitted credential paths - A restriction to credentials associated with the current project - Explicit user authorization before credential discovery - Controls preventing token contents from entering logs, prompts, or persistent records - A requirement to use an authenticated credential manager instead of filesystem discovery This conflicts with the principle of least privilege. A publishing task may legitimately need access to one specific GitHub credential, but it does not require unrestricted discovery across unrelated directories or credential stores. The package contains no executable implementation of this search, so exploitation depends on an agent interpreting and acting on the documented instruction. No instruction to disclose or transmit token values was found. ### Attack Path 1. A publishing or authentication operation fails because the expected GitHub credential is unavailable. 2. The Skill applies its documented resolution and searches multiple filesystem locations for token files. 3. The search reaches locations outside the ...[truncated 921 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all instructions to search unspecified or multiple filesystem locations for tokens. 2. Require the user to identify and authorize one exact credential source. 3. Prefer an authenticated platform client or operating-system credential manager, such as GitHub CLI authentication, without reading raw token values. 4. Restrict filesystem access to an explicit allowlist under the current project or a documented credential path. 5. Verify only whether authentication succeeds; never print, copy, summarize, or persist the credential value. 6. Redact tokens and token-like strings from command output, error logs, learning records, and agent memory. 7. Require explicit confirmation before changing credential sources or accessing a location outside the project. 8. Document the minimum required token scopes and reject overprivileged credentials.