T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:10
- Finding
- Excessive Access to Historical Sessions, Cross-Project Code, and Shell Execution## Vulnerability Details **File Location**: `SKILL.md:10`, `SKILL.md:34`, `SKILL.md:43-46` **Vulnerability Type**: Violation of least privilege through unnecessary tool permissions **Risk Level**: Medium ### Evidence ```yaml allowed-tools: Read, Grep, Glob, Bash, WebSearch, WebFetch, Write, mcp__solograph__web_search, mcp__solograph__kb_search, mcp__solograph__project_info, mcp__solograph__codegraph_query, mcp__solograph__codegraph_explain, mcp__solograph__project_code_search, mcp__solograph__session_search ``` ```markdown - If MCP `session_search` available: check if this idea was researched before in past sessions ``` ```markdown - If MCP `project_info` available: check existing projects for reusable code - If MCP `codegraph_explain` available: get architecture overview of similar existing projects - If MCP `codegraph_query` available: find shared packages across projects - If MCP `project_code_search` available: search for reusable patterns, services, infrastructure across existing projects ``` ### Technical Analysis The skill's declared purpose is to research an idea from market, user, and technical perspectives. That workflow legitimately requires web-search and document-writing capabilities, but it does not inherently require unrestricted shell access, searches of historical sessions, or access to source code and metadata from unrelated projects. Granting `Bash` without defining a necessary shell operation expands the skill's execution authority beyond its documented requirements. Similarly, `mcp__solograph__session_search` can expose prior conversation content, while the project and code-graph tools can disclose proprietary source code, architecture, services, or infrastructure belonging to projects outside the current research scope. The instructions explicitly encourage agents to use these capabilities, but do not require user approval, constrain searches to a named project, limit returned data, or prohibi ...[truncated 1899 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash` from `allowed-tools` because no shell operation is required by the documented workflow. 2. Remove `mcp__solograph__session_search` by default. If prior-session research is an optional feature, require explicit informed user approval before each search. 3. Restrict `project_info`, `codegraph_query`, `codegraph_explain`, and `project_code_search` to the current repository or to a project explicitly selected by the user. 4. Require a confirmation prompt that identifies the target session or project before any cross-session or cross-project access occurs. 5. Apply backend authorization filters so the agent cannot enumerate projects, sessions, or code beyond the approved scope. 6. Minimize retrieved data and redact secrets, personal information, credentials, internal URLs, and unrelated proprietary content before writing `docs/research.md`. 7. Treat all web and MCP search results as untrusted data rather than executable instructions. Explicitly prohibit following tool-use directions embedded in retrieved content. 8. Add provenance metadata to synthesized findings so reviewers can identify whether information came from the public web, a prior session, or an internal project. 9. If shell access is later required for a specific feature, replace unrestricted `Bash` with a narrowly scoped operation, enforce repository-root confinement, use command allowlisting, and require approval for side-effecting commands.