T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:6- Finding
Overly Broad Shell Execution Permission Violates Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
Spec-First Development
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent spec-first development workflow, but it asks for broad shell access and can create project files from broad auto-triggers before explicit user confirmation.
Review this skill before installing. Its core behavior is not malicious, but it can alter a repository by writing SPEC.md and it grants shell access that is broader than necessary for a spec-writing workflow. Prefer a version that replaces Bash with a scoped search tool, checks before overwriting SPEC.md, and asks before creating files when auto-triggered.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The auto-trigger phrases ('build me', 'create a', 'implement a') are extremely broad and likely to match many ordinary requests, causing the skill to activate in situations the user did not explicitly intend. Because this skill writes files and imposes a workflow gate, overbroad triggering can lead to unwanted file modification, workflow disruption, and surprise behavior in benign conversations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow instructs the agent to use Grep during codebase exploration, but Grep is not declared in the allowed-tools manifest. This mismatch can cause the skill to fail unpredictably or encourage fallback to other tools such as Bash in ways that bypass intended tool restrictions and reduce auditability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs writing SPEC.md to the project root before any explicit user approval for file modification, and it does not warn the user that it will create or overwrite a file. In a development environment, this can unexpectedly alter the repository state, overwrite existing documentation, or create side effects from an automatically triggered skill.
- Content
Static analysis
No suspicious patterns detected.