T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:17- Finding
Default Cross-Skill Modification Without Explicit Authorization
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17-40
Vulnerability Type: Excessive permissions and unauthorized modification of local skill files
Risk Level: MediumVulnerable Code Snippet:
markdown ## Typical ownership / permission level - This skill is typically used by the **`master`** agent. - It often requires **higher local permissions** because it may inspect and modify: - `SKILL.md` - `references/` - `scripts/` - other local skill folders ## Core rules - Prefer **thin markdown + heavier scripts**. - If a step can be scripted, it should usually be scripted. - If no extra requirements exist, prefer executing scripts instead of repeatedly re-explaining a process in chat. - `SKILL.md` should hold rules, boundaries, and confirmation points. - `scripts/` should hold mechanical checks, copying, verification, and repeatable operations. - `references/` should stay lightweight. - After review, the default is: **back up first, then modify, then show evidence**. ## Standard flow 1. Read the target `SKILL.md` 2. Inspect `scripts/` and `references/` 3. Identify verbosity, duplication, and non-scripted mechanical steps 4. Back up the target skill files 5. Improve the skill structure 6. Show backup paths, changes made, and final evidenceTechnical Analysis
The skill declares that it may operate with higher local permissions and modify files in other skill directories. It then makes modification the default action after review, without requiring explicit user approval for the proposed changes.
This violates least-privilege and authorization-boundary principles. A review task only requires read access, while modification should be treated as a separate, confirmation-gated operation. Creating a backup reduces recovery risk but does not authorize a write.
The instructions do not define:
- An allowlist of permitted skill roots.
- Canonical-path validation for t ...[truncated 2028 chars]
- Remediation
View remediation
Remediation Suggestions
- Make review strictly read-only by default. Separate assessment from remediation into distinct operating modes.
- Require explicit user confirmation immediately before any backup or write operation.
- Display the canonical target path, files to be changed, proposed diff, and backup destination before requesting confirmation.
- Restrict eligible targets to an explicit allowlist of approved skill roots.
- Resolve paths with a canonicalization mechanism and verify that every destination remains inside the approved root.
- Reject symbolic links or verify both source and resolved destination to prevent link-based path escapes.
- Run the review phase with read-only permissions and grant narrowly scoped write access only after approval.
- Write changes atomically, preserve file ownership and permissions, and verify the resulting content.
- Record the confirmed scope and changed files in an audit log.
- Update the workflow to state: “Review and propose changes; modify only after explicit confirmation.”