T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:6
- Finding
- Overly Broad Shell Execution Permission Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml name: spec-first-dev description: Spec-driven development workflow. Before writing any code, generates a comprehensive SPEC.md covering data models, user flows, API contracts, file structure, and edge cases. Forces the right order — spec first, code second. Prevents building the wrong thing. Use at the start of any non-trivial build task. argument-hint: [project description or goal] allowed-tools: Read, Write, Bash, Glob metadata: version: "1.0.0" ``` ### Technical Analysis The skill grants access to `Bash`, which generally permits arbitrary shell-command execution under the operating-system account running the agent. The documented workflow only requires discovering files, searching source code, reading content, and writing a specification. Those operations can be supported by narrowly scoped file and search tools. The skill explicitly instructs the agent to use Grep during codebase exploration, but `Grep` is not included in the allowlist. Instead, the substantially more powerful `Bash` tool is granted. If the agent uses Bash to compensate for the missing search tool, it receives capabilities far beyond source-code searching, including executing programs, modifying or deleting files, inspecting files outside the project, and potentially initiating network connections where the environment permits them. This is a least-privilege violation. The skill does not itself instruct the agent to execute malicious commands, so the issue is excessive capability exposure rather than demonstrated malicious execution. ### Attack Path 1. A user invokes the skill against a repository containing attacker-controlled content. 2. The skill directs the agent to explore that repository before creating `SPEC.md`. 3. During exploration, malicious or adversarial repository content attempts to ind ...[truncated 1426 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `Bash` from the default tool allowlist. 2. Add the narrowly scoped `Grep` capability that the workflow actually requires: ```yaml allowed-tools: Read, Write, Glob, Grep ``` 3. Restrict writes to the project root and, where feasible, specifically to `SPEC.md` and the optional `SPEC_APPROVED.md`. 4. If shell access is operationally unavoidable, replace unrestricted Bash access with an allowlisted command interface that permits only read-only search operations and rejects shell metacharacters, command substitution, pipelines, redirection, and arbitrary executable paths. 5. Run the skill in a filesystem sandbox limited to the target project, with outbound network access disabled and sensitive environment variables removed. 6. Require explicit user approval for any command that is not a read-only codebase inspection operation. ]]>