T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:39
- Finding
- Unbounded File Discovery and Bulk Modification Outside the Declared Package Scope## Vulnerability Details **File Location**: `SKILL.md`, lines 39–41 and 80–81 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English rendering of the relevant instructions: ```text 4. Inspection scope - All files in briefing_package: config.yaml, system_prompt.md, rules_compact.md, scenarios/*.yaml, data/*.yaml, and rules_sections/*.md - Rules and scenario files outside briefing_package must also be checked Transitional-file reminder: Check all official files in briefing_package, plus the latest official rules, scenarios, and character sheets outside briefing_package. Efficiency tip: Read all files requiring inspection at the same time, replace abbreviations in bulk, and write them back at the same time. ``` ### Technical Analysis The skill is advertised as checking and correcting English abbreviations within a `briefing_package`. Its operational instructions nevertheless direct the agent to discover and modify rules, scenarios, and character sheets outside that package. The external targets are not identified through explicit paths or a user-approved allowlist. Instead, the skill relies on subjective concepts such as the “latest official” file. Combining heuristic file selection with instructions to perform bulk replacement and write all results back breaks the principle of least privilege and creates an unsafe authorization boundary. Although the skill does not contain executable scripts or directly elevate operating-system privileges, it attempts to expand the agent's effective file-access scope beyond the task described in its metadata. The risk is especially significant when the agent has broad workspace write permissions. ### Attack Path 1. A user invokes the skill to correct abbreviations in a specific `briefing_package`. 2. The agent loads the skill and follows its expanded ins ...[truncated 1415 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict all reads and writes to a canonical, user-supplied `briefing_package` root directory. 2. Remove the default instruction to inspect rules, scenarios, or character sheets outside that root. 3. If external files are genuinely required, enumerate their normalized paths and request explicit user approval before reading or modifying them. 4. Reject paths that escape the approved root through parent-directory traversal, symbolic links, or ambiguous relative paths. 5. Replace subjective “latest official file” discovery with an explicit manifest or user-provided file list. 6. Generate a preview or unified diff before applying replacements. 7. Require confirmation before bulk writes and preserve recoverable backups or use version-control checkpoints. 8. Apply changes atomically per file and report every modified path, rather than overwriting all selected files without an intermediate review. 9. Update the skill metadata and operational instructions so that the advertised scope and actual behavior are consistent.