T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:150- Finding
Unbounded Project-Wide File Discovery and Unspecified Persistent Writes
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:5-10,SKILL.md:150-158, andSKILL.md:270
Vulnerability Type: Excessive filesystem access and insufficiently constrained project modification
Risk Level: MediumEvidence
The skill grants broad filesystem discovery, read, and write capabilities:
yaml allowed-tools: - Read - Write - Glob - Grep - TaskThe following is an English translation of the relevant instructions at lines 150-158:
text Step 1: Load novel context Search the project directory and independently determine which files contain character descriptions, style references, or historical illustration records. Read them and build character profiles. Step 2: Character consistency analysis Extract the visual characteristics of each character from the files that were read. If descriptions conflict, use the earliest illustration record. If no character definition file exists, extract a first impression from the chapter text and write the character traits into the project for later reuse.The instruction at line 270 further expands project-wide discovery:
text Search existing illustration records to avoid generating the same scene again. If regeneration is necessary, mark it as a remake and explain the reason.Technical Analysis
The skill's legitimate purpose is to generate illustration prompts from novel chapters and associated character references. However, it instructs the agent to search the entire project and independently decide which files may be relevant. No permitted directory list, file extension allowlist, maximum traversal depth, sensitive-file exclusion policy, or user approval boundary is defined.
Determining relevance may itself require reading candidate files. Consequently, unrelated source code, configuration files, private notes, environment files, credentials, or other sensitive project content could enter the agent context before being rejected as irrelevant.
The skill a ...[truncated 2885 chars]
- Remediation
View remediation
Remediation Suggestions
-
Restrict discovery to explicitly approved directories, such as:
text chapters/ characters/ illustrations/ -
Define an allowlist of expected file types, such as Markdown, plain text, and a documented JSON schema.
-
Explicitly exclude sensitive and unrelated paths, including:
text .env .git/ .ssh/ credentials/ secrets/ node_modules/ build/ dist/ hidden files private keys source-code and infrastructure directories not selected by the user -
If approved directories are unavailable, ask the user to identify the chapter and reference files instead of searching the whole project.
-
Limit writes to a dedicated path, such as
illustrations/character-profiles.json, and document its schema. -
Require a preview and explicit user confirmation before creating or modifying persistent project files.
-
Use create-only or atomic-update behavior. Do not overwrite an existing file unless the user explicitly approves the exact destination and change.
-
Validate the canonical destination path before writing, reject path traversal, and avoid following symbolic links outside the approved project subtree.
-
Minimize loaded content by extracting only necessary character and style fields rather than retaining complete unrelated files in context.
-
Remove
Taskfromallowed-toolsunless a specific requirement is documented. If it is necessary, constrain delegated tasks to the same approved read and write boundaries.
-