T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:9- Finding
Excessive Tool Permissions Violate Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 9
Vulnerability Type: Excessive agent permissions
Risk Level: MediumVulnerable Code
yaml allowed-tools: [Read, Write, Exec, Message, WebSearch]Technical Analysis
The skill’s documented purpose is to research financial events, validate public sources, and generate investment analysis.
WebSearchis directly relevant to this workflow, while narrowly scopedReadandWritepermissions may be justified for user-requested reports or event tracking.However, the skill does not document any legitimate need for arbitrary command execution through
Execor outbound communication throughMessage. Granting these capabilities violates the principle of least privilege and unnecessarily expands the impact of prompt injection or malicious external content encountered during web research.The permission declaration is not itself evidence that commands or messages are currently executed maliciously. The risk arises because unnecessary high-impact capabilities are available to the agent while it processes potentially attacker-controlled web content.
Attack Path
- A user asks the skill to analyze an event or produce a weekly event report.
- The skill uses
WebSearchto retrieve relevant sources. - An attacker-controlled search result contains prompt-injection instructions disguised as financial data or source-validation guidance.
- The agent interprets those instructions as actionable content.
- Because the skill has
Exec,Write, andMessagepermissions, the injected instructions may attempt to:- Execute local operating-system commands.
- Modify files accessible to the agent.
- Transmit collected information through messaging capabilities.
- These actions would occur with the permissions of the agent runtime, extending the compromise beyond the legitimate research task.
This is a conditional exploitation path: successful exploitation depends on the runt ...[truncated 725 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove capabilities that are not required by the documented workflow:
yaml allowed-tools: [WebSearch] -
If report persistence or event tracking genuinely requires filesystem access, grant only narrowly scoped read/write access to a dedicated workspace:
yaml allowed-tools: [WebSearch, Read, Write] -
Remove
Execunless a specific, reviewed command-execution use case is introduced. If it must be retained:- Use an isolated sandbox with no secrets.
- Apply an explicit command allowlist.
- Disable shell interpretation where possible.
- Block network-capable commands.
- Require user confirmation before every execution.
-
Remove
Messageunless outbound communication is a documented feature. If retained:- Restrict approved recipients and channels.
- Require explicit user confirmation.
- Prevent transmission of local files, credentials, or session data.
-
Treat all web results as untrusted data:
- Do not follow instructions embedded in retrieved pages.
- Extract only factual content relevant to the user’s request.
- Enforce tool-policy checks independently of model-generated decisions.
-
Add automated validation that fails package publication when declared tools exceed a maintained allowlist for the skill’s stated function.
-