T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unnecessary Shell and Local File Access Permissions## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool permissions violating the principle of least privilege **Risk Level**: Medium ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill declares access to both `Bash` and `Read`, although its documented purpose is to connect to the Pixshop remote MCP service and invoke image and video processing tools. The documented workflows do not require arbitrary shell command execution or unrestricted access to local files. Granting these capabilities expands the skill's security boundary beyond its stated functional requirements. If malicious instructions are introduced through compromised remote MCP responses, indirect prompt injection, or a future modification to the skill, the agent could be induced to read local files or execute shell commands. This finding concerns the excessive permissions declared by the skill; the audited file does not itself contain commands that actively exploit those permissions. ### Attack Path 1. A user loads the skill, giving the agent access to the declared `Bash` and `Read` tools. 2. The agent communicates with the external Pixshop MCP endpoint as directed by the skill. 3. A compromised service response, attacker-controlled content processed during the workflow, or a later malicious instruction attempts to influence the agent. 4. Because the skill has unnecessary local capabilities, the influenced agent may read local files or execute shell commands unrelated to image or video processing. 5. Data obtained through those capabilities could potentially be exposed in subsequent tool requests or used to affect the local environment. ### Impact Assessment Successful exploitation could provide access to files readable by the user running the agent and allow command execution with that user's operating-system privileges. The practical scope depends on the host application's authorization con ...[truncated 407 chars]
- Remediation
- ## Remediation Suggestions - Remove `Bash` and unrestricted `Read` from the `allowed-tools` declaration. - Grant access only to the specific Pixshop MCP tools required for the documented image and video workflows. - If local configuration access is genuinely necessary, restrict file operations to the exact MCP configuration file and use narrowly scoped read or write capabilities. - Require explicit user confirmation before any local file access, shell execution, paid credit-consuming operation, biometric-image processing, or public publishing action. - Treat responses and resources returned by the remote MCP service as untrusted data and prevent them from authorizing additional tool calls. - Apply host-level sandboxing and outbound-data controls to limit the consequences of indirect prompt injection or remote-service compromise.