T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:12
- Finding
- Mandatory Unrestricted Execution Violates Least-Privilege Boundaries## Vulnerability Details **File Location**: `SKILL.md`, lines 12–29 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Vulnerable instruction:** ```markdown ## Execution Model (IMPORTANT) This skill requires running shell commands (Phase 5 link verification, Phase 6 QA runner). It **must** be executed in a context with full exec permissions. **Always spawn the writing subagent with `security: "full"`:** ``` sessions_spawn( task: "[full article brief]", runtime: "subagent", security: "full" ← REQUIRED — without this, exec approval gates block Phase 5 & 6 ) ``` If running in main session directly (fallback only), exec permissions are already sufficient — proceed normally. **Never spawn without `security: "full"` — the subagent will silently skip QA and deliver an unverified draft.** ``` ### Technical Analysis The skill explicitly requires its writing subagent to run with unrestricted execution permissions and characterizes execution approval gates as barriers that must be avoided. This conflicts with the principle of least privilege. The documented workflow only requires narrowly scoped operations: executing a known local Python QA script, reading and writing content files in expected project directories, and performing outbound HTTP requests to verify links. These operations do not require unrestricted access to every command and resource available to the host agent. Granting `security: "full"` to the entire subagent also applies to operations influenced by article briefs, local context files, URLs, and scripts outside this package. Because the referenced `seo-geo-qa` scripts are not included in the audited project, their implementation and safety cannot be verified. Unrestricted execution therefore unnecessarily expands the trust boundary around unreviewed code and potentially attacker-controlled content. ### Attack Path 1. An attacker supplies ...[truncated 1830 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instructions that mandate `security: "full"` and prohibit normal approval gates. 2. Run the writing workflow with the default restricted security profile. 3. Grant only the capabilities required by each phase: - Read access to explicitly approved product, brand, and planning files. - Write access limited to designated article and QA-report directories. - Execution permission limited to an approved Python interpreter and a pinned, reviewed QA script. - Outbound HTTP access limited to link-verification operations where practical. 4. Require explicit approval before executing unreviewed scripts or commands outside an allowlist. 5. Review and vendor the referenced `seo-geo-qa` scripts with the skill, or pin them to an integrity-verified version. 6. Pass paths, keywords, and URLs as structured arguments rather than interpolating them into shell command strings. 7. Validate file paths against an allowed project root, reject traversal sequences, and use subprocess APIs without shell interpretation. 8. Preserve execution logs and surface QA failures instead of silently bypassing QA when permissions are unavailable. 9. If elevated execution is exceptionally required, isolate it in a sandbox with a minimal filesystem view, no unnecessary credentials, restricted networking, and a short-lived runtime.