T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:437
- Finding
- Unrestricted Filesystem Scanning Outside the Declared Workspace## Vulnerability Details **File Location**: `SKILL.md`, lines 437-443 **Vulnerability Type**: Unrestricted filesystem access **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **⚠️ Path scanning (`/wt loops`):** The `/wt loops` command accepts an arbitrary directory path argument. It will recursively scan the specified directory for loop patterns (TODO, FIXME, etc.). This is a read-only operation but can scan any directory you have filesystem access to. The skill does NOT restrict which paths can be scanned — use caution with sensitive directories. Consider using `--exclude` to skip sensitive paths. ``` ### Technical Analysis The `/wt loops` interface accepts an arbitrary directory and recursively reads files using the permissions of the hosting agent. The documentation explicitly states that no path restrictions are enforced. This behavior exceeds the paths declared in the skill metadata, which only identifies configuration files and output directories. Read-only access still presents a confidentiality risk because sensitive file paths and matching file contents can be included in generated reports under `output/loops/`. User-provided exclusions are not a security boundary. They depend on the caller correctly identifying sensitive locations and do not protect against malicious instructions, path traversal, absolute paths, or symbolic links resolving outside the intended workspace. ### Attack Path 1. An attacker supplies or influences a workflow request containing `/wt loops` with an absolute path, traversal path, or symbolic-link-backed directory. 2. The skill recursively scans that directory using the agent's filesystem permissions. 3. Files containing recognized markers such as `TODO`, `FIXME`, `HACK`, or attacker-selected custom patterns are identified. 4. Matching file paths and content are returned to the session or persisted under `output/loops/`. 5. The attacker obtains information from files outside the legitimate workflow scope t ...[truncated 459 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict scanning to the current workspace by default. 2. Resolve every supplied path to its canonical absolute path before access and verify that it remains beneath an approved root. 3. Reject `..` traversal, absolute paths outside approved roots, and symbolic links that escape the workspace. 4. Maintain a default denylist for sensitive paths such as credential stores, SSH directories, agent state, version-control secrets, and system configuration. 5. Require explicit interactive confirmation before reading any location outside the workspace. 6. Apply limits for recursion depth, file count, file size, and scan duration to reduce unintended exposure and denial-of-service risk. 7. Redact sensitive values and minimize file content written to reports. 8. Update the declared permission metadata so that the effective filesystem access is transparent and enforceable.