T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:8- Finding
Overly Broad Tool Permissions Violate Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 8
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: MediumVulnerable Configuration
yaml allowed-tools: [Bash, Read, Write, Exec, WebSearch]Technical Analysis
The skill permits arbitrary shell execution, process execution, filesystem reads, filesystem writes, and web searches. Its documented functions are limited to investment-data retrieval, portfolio analysis, KYC questioning, and Markdown report generation. No shell commands, local executables, or use case requiring unrestricted host access are defined in the project.
Granting
BashandExeccreates a general-purpose code-execution channel. BroadReadandWriteaccess also permits access to files outside the skill package and intended report-output area. This violates least privilege and increases the consequences of malicious user input, a compromised delegated skill, or unsafe content returned by an external data source.The audit found no commands that currently exploit these permissions, no embedded malicious scripts, and no remote payload retrieval. The risk arises from the unnecessary authority exposed by the configuration.
Attack Path
A potential exploitation path is:
- An attacker supplies crafted content through a user request, external market-data response, or compromised delegated skill.
- That content influences the agent into invoking one of the broadly authorized tools.
- The agent uses
Readto access unintended local files or usesBash/Execto run attacker-selected commands. - The process executes with the filesystem and operating-system privileges of the agent runtime.
- If
Writeis available outside a constrained output directory, the attacker may also alter files accessible to that runtime.
This path depends on a separate mechanism capable of influencing tool invocation; no such exploit payload was identified in the audited package.
...[truncated 574 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
BashandExecunless a concrete, reviewed operation requires them. - Replace unrestricted tools with narrowly scoped financial-data APIs and report-generation capabilities.
- Restrict
Readaccess to explicitly allowlisted package files, such asreferences/andtemplates/. - Restrict
Writeaccess to a dedicated report-output directory using canonical-path validation and deny path traversal. - Allowlist required network destinations and operations instead of granting unrestricted
WebSearch. - Run the skill in a sandbox with a read-only filesystem, except for its dedicated output directory.
- Ensure the runtime has no access to unrelated credentials, environment secrets, SSH material, or sensitive host paths.
- Require explicit user confirmation before any operation that writes files or invokes external processes.
- Add tests that verify attempts to read, write, or execute outside the declared workflow are denied.
- Remove