T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:64
- Finding
- Excessive Gateway Restart Privilege for Heartbeat Cleanup## Vulnerability Details **File Location**: `SKILL.md`, line 64 **Vulnerability Type**: Excessive administrative privilege **Risk Level**: Medium ### Vulnerable Code ```markdown - If cron removal fails due to gateway timeout, retry removal; if still stuck, use gateway restart (requires `commands.restart: true`) and retry. ``` ### Technical Analysis The skill directs the agent to obtain and use the privileged `commands.restart` capability when removal of a heartbeat cron job repeatedly fails. Restarting a shared gateway is substantially broader than removing a skill-owned scheduled job and therefore violates the principle of least privilege. The heartbeat function can be implemented without service-administration privileges by using an in-turn loop, self-expiring scheduled jobs, bounded removal retries, or delayed idempotent cleanup. A transient or induced gateway timeout should not authorize an infrastructure-wide recovery action. ### Attack Path 1. A long-running task causes the skill to create a heartbeat cron job. 2. Removal of that job fails or appears to fail because of gateway timeouts. 3. The prescribed retries and delayed cleanup do not succeed. 4. Following the skill instruction, the agent invokes the privileged gateway-restart operation. 5. Restarting the shared gateway disrupts unrelated operations and sessions using that service. No mechanism for deliberately inducing the prerequisite timeout was identified in the reviewed file. Exploitation therefore depends on an operational failure or an external actor already capable of interfering with the gateway. ### Impact Assessment Successful invocation grants the skill access to a service-wide administrative operation beyond its legitimate notification and cron-cleanup requirements. The primary impact is availability loss: unrelated tasks, sessions, or integrations using the gateway may be interrupted. The reviewed material does not show a path to data disclosure, arbitrary code execution, or fu ...[truncated 28 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to restart the gateway and eliminate the skill's dependency on `commands.restart`. 2. Prefer the documented in-turn heartbeat loop so task completion naturally terminates updates without persistent scheduled jobs. 3. If cron is unavoidable, create a self-expiring heartbeat job with a strict maximum lifetime. 4. Retain bounded, idempotent cron-removal retries with exponential backoff. 5. Use a one-time delayed cleanup job as the final automated recovery mechanism and ensure that it also expires. 6. After cleanup retries are exhausted, notify the user or administrator and require explicit authorization before any service-wide recovery action. 7. Scope all cleanup operations to the recorded `heartbeatJobId`, validating that the identifier belongs to the current task before removal.