T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:5
- Finding
- Excessive Shell Execution Permissions Violate Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, lines 5–13 **Vulnerability Type**: Excessive command-execution permissions **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: - get_lottery_result - ocr_lottery_ticket - check_lottery_win - get_lottery_countdown - get_lottery_calendar - Bash(node:*) - Bash(npx:*) - Bash(mcporter:*) ``` ### Technical Analysis The skill grants unrestricted Bash execution for `node`, `npx`, and `mcporter`. Its documented lottery workflows require calls to the configured `amcjt-mcp-server` through `mcporter`; no documented workflow requires general-purpose `node` or `npx` execution. `node` can execute arbitrary JavaScript and access files, environment variables, processes, and the network under the agent user's privileges. `npx` can additionally retrieve and execute npm packages whose contents may change independently of this reviewed skill. The wildcard rules do not constrain arguments, scripts, packages, or `mcporter` methods. This unnecessarily expands the skill's authority beyond its legitimate functionality and violates least-privilege principles. The permission declaration does not itself prove that malicious commands are currently executed, but it creates an exploitable execution channel if attacker-controlled instructions or arguments influence tool selection. ### Attack Path 1. The skill is activated through one of its lottery-related trigger phrases. 2. An attacker supplies crafted content that influences the agent's tool invocation, such as instructions embedded in a user request or other untrusted content handled during the session. 3. The agent invokes an allowed wildcard command: - `Bash(node:*)` to execute arbitrary JavaScript; - `Bash(npx:*)` to retrieve and execute an npm package; or - `Bash(mcporter:*)` to call an unintended configured MCP operation. 4. The command executes with the permissions of the agent process. 5. The resulting code or tool call can access ...[truncated 773 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the undocumented general-purpose execution permissions: ```yaml allowed-tools: - get_lottery_result - ocr_lottery_ticket - check_lottery_win - get_lottery_countdown - get_lottery_calendar - Bash(mcporter:*) ``` 2. Prefer direct, typed lottery tools over shell access whenever the host platform supports them. 3. If `mcporter` must be invoked through Bash, replace the wildcard with argument-level allowlisting restricted to: - The trusted `amcjt-mcp-server` server identifier. - `get_lottery_result`. - `ocr_lottery_ticket`. - `check_lottery_win`. - `get_lottery_countdown`. - `get_lottery_calendar`. 4. Reject shell metacharacters, additional commands, unapproved server names, and unsupported method names before invocation. 5. Validate all user-derived values against strict schemas: - Issue number: exactly four year digits followed by three sequence digits. - Lottery type: fixed to the string `"101"`. - Red numbers: six unique values from `01` through `33`. - Blue number: one value from `01` through `16`. - Image input: a canonical path to an approved workspace file with an allowed image type. 6. Pin and independently verify the configured MCP endpoint before transmitting ticket images or betting information. 7. Run the skill in a sandbox with minimal filesystem access, no unnecessary credentials, restricted outbound networking, and no package-installation capability.