T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:437- Finding
Unrestricted Filesystem Scanning Outside the Declared Workspace
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 437-443
Vulnerability Type: Unrestricted filesystem access
Risk Level: MediumVulnerable Code Snippet
markdown **⚠️ Path scanning (`/wt loops`):** The `/wt loops` command accepts an arbitrary directory path argument. It will recursively scan the specified directory for loop patterns (TODO, FIXME, etc.). This is a read-only operation but can scan any directory you have filesystem access to. The skill does NOT restrict which paths can be scanned — use caution with sensitive directories. Consider using `--exclude` to skip sensitive paths.Technical Analysis
The
/wt loopsinterface accepts an arbitrary directory and recursively reads files using the permissions of the hosting agent. The documentation explicitly states that no path restrictions are enforced.This behavior exceeds the paths declared in the skill metadata, which only identifies configuration files and output directories. Read-only access still presents a confidentiality risk because sensitive file paths and matching file contents can be included in generated reports under
output/loops/.User-provided exclusions are not a security boundary. They depend on the caller correctly identifying sensitive locations and do not protect against malicious instructions, path traversal, absolute paths, or symbolic links resolving outside the intended workspace.
Attack Path
- An attacker supplies or influences a workflow request containing
/wt loopswith an absolute path, traversal path, or symbolic-link-backed directory. - The skill recursively scans that directory using the agent's filesystem permissions.
- Files containing recognized markers such as
TODO,FIXME,HACK, or attacker-selected custom patterns are identified. - Matching file paths and content are returned to the session or persisted under
output/loops/. - The attacker obtains information from files outside the legitimate workflow scope t ...[truncated 459 chars]
- An attacker supplies or influences a workflow request containing
- Remediation
View remediation
Remediation Suggestions
- Restrict scanning to the current workspace by default.
- Resolve every supplied path to its canonical absolute path before access and verify that it remains beneath an approved root.
- Reject
..traversal, absolute paths outside approved roots, and symbolic links that escape the workspace. - Maintain a default denylist for sensitive paths such as credential stores, SSH directories, agent state, version-control secrets, and system configuration.
- Require explicit interactive confirmation before reading any location outside the workspace.
- Apply limits for recursion depth, file count, file size, and scan duration to reduce unintended exposure and denial-of-service risk.
- Redact sensitive values and minimize file content written to reports.
- Update the declared permission metadata so that the effective filesystem access is transparent and enforceable.