T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:10
- Finding
- Excessive Shell Permission and Overly Broad Local Search Scope## Vulnerability Details **File Location**: `SKILL.md:10, 36-37` **Vulnerability Type**: Excessive permissions and insufficiently scoped local data access **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Read, Grep, Bash, Glob, Write, Edit, AskUserQuestion, WebSearch, mcp__solograph__kb_search, mcp__solograph__project_info, mcp__solograph__web_search ``` ```markdown Otherwise search locally: - Grep for idea keywords in `.md` files across the project and knowledge base ``` ### Technical Analysis The skill requests unrestricted `Bash` access even though its documented validation workflow does not identify any operation that requires arbitrary shell-command execution. This violates the principle of least privilege: compromise or misuse of the skill's instructions would have access to a substantially more powerful execution channel than the legitimate task requires. The local fallback search is also insufficiently bounded. It directs the agent to search Markdown files “across the project and knowledge base” without specifying approved directories, exclusions, maximum traversal depth, or handling rules for sensitive results. Depending on the host environment, this scope could include unrelated private notes, internal documentation, persistent agent state, or conversation-derived files. No instruction was found that explicitly transmits local file contents to an external party. Therefore, the issue establishes unnecessary access and disclosure risk, not confirmed exfiltration or malicious intent. ### Attack Path 1. The skill is invoked with `Bash`, `Read`, `Grep`, and `Glob` permissions. 2. The fallback workflow searches unspecified Markdown files throughout the project and knowledge base. 3. An unrelated sensitive document or a document containing adversarial prompt instructions matches the idea keywords. 4. The matched content enters the agent's context. 5. Sensitive content may be reproduced in va ...[truncated 1173 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash` from `allowed-tools` because no documented workflow step requires arbitrary command execution. 2. Retain only the minimum necessary tools, such as `Read`, narrowly scoped `Grep` or `Glob`, `Write` for the designated PRD, user prompting, and approved search integrations. 3. Restrict fallback searches to explicit approved paths, such as `docs/research/` and a user-selected knowledge-base directory. 4. Define exclusions for hidden directories, credentials, memory or state stores, conversation logs, configuration files, generated outputs, and unrelated project directories. 5. Require explicit user approval before searching outside the current project's designated research directory. 6. Constrain write operations to `docs/prd.md` or a user-approved destination rather than granting general project modification capability. 7. Treat all retrieved local and remote documents as untrusted data. Explicitly instruct the agent not to follow commands embedded in search results. 8. Apply host-level sandboxing and filesystem allowlists so skill metadata alone cannot grant access beyond the task-specific workspace. 9. Add limits for search depth, file count, file size, and result volume to reduce unintended collection. 10. Redact sensitive values before incorporating retrieved material into generated reports.