T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:8- Finding
Unnecessary Unrestricted Shell Permission
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 8-16
Vulnerability Type: Excessive system permission
Risk Level: MediumComplete Code Snippet:
yaml allowed-tools: - Read - Grep - Glob - Shell - Edit - WriteTechnical Analysis
The Skill consists entirely of Markdown instructions and templates and includes no packaged scripts requiring operating-system command execution. Its documented computational operations are report generation, data extraction, and numerical analysis. Nevertheless, the configuration grants unrestricted access to
Shell.This violates the principle of least privilege. A general-purpose shell can execute arbitrary local commands, access files available to the Agent process, launch other programs, alter project data, and potentially initiate network requests. The permission therefore exposes substantially more capability than is necessary for the declared consulting workflow.
Uploaded reports, spreadsheets, transcripts, and externally retrieved research are potentially attacker-controlled inputs. If such content contains prompt-injection instructions that influence tool selection, unrestricted Shell access could turn a document-processing attack into arbitrary command execution within the Agent's security context.
Attack Path
- A user or external source supplies a malicious document containing instructions designed to induce command execution.
- The Skill reads the document while processing a report, interview transcript, or research task.
- The embedded instructions influence the Agent to invoke
Shell. - The Agent executes arbitrary commands with the filesystem, process, and network privileges of its runtime account.
- The attacker may access or modify data reachable by that account, subject to the surrounding sandbox and operating-system controls.
Impact Assessment
Successful exploitation could permit command execution un ...[truncated 488 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
Shellfromallowed-toolsunless a concrete workflow requires it. - Replace general shell access with a constrained calculation or code-execution environment that has:
- No unrestricted host filesystem access.
- No network access by default.
- Resource and execution-time limits.
- An isolated temporary working directory.
- If shell access is unavoidable, allowlist specific executables and validated argument patterns rather than permitting arbitrary commands.
- Require explicit user confirmation before commands that read outside the task workspace, modify files, invoke network clients, or launch additional processes.
- Treat uploaded documents and web content strictly as untrusted data and prohibit instructions found inside them from authorizing tool calls.
- Log shell invocations and reject commands containing chaining, redirection, command substitution, or dynamic code evaluation unless independently justified.
- Remove