T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:93
- Finding
- Read-Only Monitoring Skill Recommends Privileged and State-Changing Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 93–96 **Vulnerability Type**: Least-privilege and declared-scope violation **Risk Level**: Medium ### Evidence The following is an English translation of the complete affected table section; command literals are preserved exactly: ```markdown | Symptom | Cause | Resolution | |---------|-------|------------| | CPU remains at 100% | A process is consuming all resources | Use `top` to identify the high-usage process; use `kill` or reduce the workload | | Temperature above 90°C | Insufficient cooling | Install a heat sink or fan; reduce the BPU workload | | BPU ratio always remains at 0 | No inference task is running | This is normal; the value will increase after starting AI inference | | Disk is full | Logs or backups are too large | Run `du -sh /var/log/*`; run `sudo apt clean` | ``` ### Technical Analysis The Skill declares itself as a read-only system-monitoring capability and explicitly directs system-changing operations to a separate system-management Skill. Most documented commands comply with that boundary by reading procfs, sysfs, network, memory, and filesystem statistics. The troubleshooting guidance violates this boundary in two ways: 1. `kill` terminates or signals a process and therefore changes system state. If used without identifying the correct process and signal, it can interrupt critical applications or system services. 2. `sudo apt clean` requests elevated execution and deletes cached package files. This is a privileged, state-changing maintenance operation rather than a monitoring query. The file does not automatically execute either command, and it does not independently bypass authentication or grant new privileges. Exploitation requires an agent or user to follow the recommendations and, for the `sudo` command, already possess suitable sudo authorization. Nevertheless, embedding these recommendations in a read-only Skill breaks least-privilege separation and c ...[truncated 1710 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `kill` and `sudo apt clean` from this read-only monitoring Skill. 2. Restrict troubleshooting instructions to diagnostic commands that do not modify system state, such as: - `top` - `ps` - `du -sh /var/log/*` - `df -h` 3. Refer users to the designated system-management Skill when remediation requires process termination, cache deletion, workload changes, or other administrative actions. 4. Require explicit user confirmation before any state-changing command is executed. 5. Before process termination, display the target PID, process owner, full command line, intended signal, and likely operational impact. 6. Avoid recommending broad privileged commands. If package-cache cleanup is necessary, explain precisely what will be deleted and verify available disk space before and after the operation. 7. Add an explicit policy to the Skill stating that it must not execute commands using `sudo`, terminate processes, delete files, or modify system configuration. ]]>