T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:20
- Finding
- Overbroad Modification of Files Outside the Intended Output Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–22 and line 74 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is a faithful English translation of the relevant instructions: ```text The scope of files you need to modify is: ✅ All official files inside briefing_package (config.yaml, system_prompt.md, rules_compact.md, scenarios/*.yaml, data/*.yaml, rules_sections/*.md, maps/*.yaml) ✅ The latest official rules files, scenario files, character sheets, and other official files still in use outside briefing_package ⚠️ Inspection scope: not only files inside briefing_package; rules and scenario files outside briefing_package must undergo the same inspection. ``` ### Technical Analysis The Skill's declared function is to convert TRPG rules into a `briefing_package`. Producing that package only requires reading source documents and writing conversion results to the designated output directory. However, the instructions explicitly direct the agent to modify active rules, scenarios, character sheets, and other files outside `briefing_package`. No explicit path allowlist, per-file approval, backup requirement, dry-run mode, or diff review is required before those modifications occur. This violates least-privilege principles by expanding write operations beyond the files necessary to create the requested output. The risk is amplified by other transformation requirements in the Skill, including terminology normalization and removal or omission of multiplayer content. If applied directly to canonical source documents, those operations can cause destructive or semantically significant changes. The Skill does not independently acquire new operating-system privileges. It instead encourages overuse of whatever filesystem write permissions the hosting agent already possesses. ### Attack Path 1. A user invokes the Skill to conv ...[truncated 1541 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict all generated and modified files to an explicitly designated directory, such as `briefing_package/`. 2. Treat source rules, scenarios, and character sheets outside that directory as read-only by default. 3. Remove the instruction requiring normalization or modification of files outside the output package. 4. If source-file editing is genuinely required, obtain explicit user approval for a precise file allowlist before writing. 5. Present a proposed modification plan and diff for review before changing any existing source document. 6. Create backups or require a clean version-control checkpoint before approved source-file modifications. 7. Resolve and validate paths before writing, rejecting path traversal and targets outside the approved output root. 8. Separate conversion behavior from optional source-maintenance behavior so users can authorize them independently. ]]>