T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Excessive File Modification and Browser Permissions## Vulnerability Details **File Location**: `SKILL.md:8-14` **Vulnerability Type**: Excessive tool permissions violating least privilege **Risk Level**: Medium ```yaml allowed-tools: - Read - Write - Edit - AskUserQuestion - BrowserUse ``` ### Technical Analysis The Skill is designed to analyze image requirements, consult bundled documentation, recommend visual options, and produce image-generation prompts. These operations legitimately require document-reading and user-interaction capabilities, but the declared permissions additionally grant unrestricted `Write` and `Edit` capabilities. No reviewed workflow, template, or example requires modifying local files. Granting these capabilities therefore exceeds the Skill's documented operational requirements and increases the consequences of malicious or adversarial input. If the host platform treats `allowed-tools` as an authorization boundary, content processed by the Skill could attempt to induce the Agent to overwrite or alter any files accessible through those tools. `BrowserUse` may be relevant to the optional image-generation stage, but the configuration does not limit it to approved image-generation services, trusted destinations, or explicit user-confirmed operations. This unnecessarily broadens the network interaction surface. ### Attack Path 1. A user activates the Skill with an image or prompt-generation request. 2. The request includes adversarial instructions disguised as image content, reference material, or a required workflow step. 3. Because `Write` and `Edit` are authorized, the adversarial content attempts to convince the Agent to create, overwrite, or modify an accessible project or configuration file. 4. Alternatively, the content directs `BrowserUse` to an attacker-selected or otherwise unintended destination. 5. If the Agent follows those instructions without an independent authorization check, the attacker can cause file modification ...[truncated 1032 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Write` and `Edit` from `allowed-tools`, because no documented Skill operation requires local file modification. 2. Use a least-privilege default configuration containing only `Read` and `AskUserQuestion` for prompt analysis and generation. 3. Move optional direct image generation into a separate, explicitly invoked workflow with user confirmation. 4. If browser access is necessary, restrict it to an allowlist of trusted image-generation endpoints and prohibit arbitrary navigation. 5. Require a clear confirmation showing the destination and intended data before any browser request. 6. Enforce host-level filesystem sandboxing and deny writes outside a dedicated output directory if future functionality genuinely requires file creation. 7. Add tests confirming that image-related user content cannot trigger file modification or navigation to unapproved destinations.