T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Excessive Tool Permissions Violate Least-Privilege Principles## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: Excessive shell and filesystem permissions **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml allowed-tools: [Bash, Read, Write] ``` ### Technical Analysis The Skill is a text-based framework for clarifying problems, defining success criteria, assessing risks, and preparing action plans. None of the reviewed workflows require arbitrary shell-command execution or unrestricted filesystem access. Nevertheless, the Skill declares access to `Bash`, `Read`, and `Write`. In particular, `Bash` can provide broad command-execution capabilities, while `Read` and `Write` may expose or modify files available to the hosting Agent. This unnecessarily expands the Skill's authority and violates the principle of least privilege. No instructions that deliberately invoke these tools, execute malicious commands, or access sensitive files were found. The risk arises from making powerful capabilities available when they are not necessary for the documented task. Exploitation would therefore depend on the hosting platform permitting a malicious or prompt-injected input to influence tool invocation. ### Attack Path 1. The hosting Agent loads the Skill and grants the tools declared in `allowed-tools`. 2. An attacker supplies adversarial problem text containing prompt-injection instructions. 3. The injected content attempts to induce the Agent to invoke `Bash`, `Read`, or `Write` outside the legitimate problem-mapping workflow. 4. If the host does not independently enforce tool authorization, path restrictions, and command validation, the Agent may execute commands, read accessible files, or modify filesystem content. 5. The resulting access remains limited by the operating-system privileges and sandbox controls applied to the Agent process. This is a conditional exploitation path. The audited project itself contains no command payload, persistence m ...[truncated 789 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash`, `Read`, and `Write` from `allowed-tools` because the documented analysis workflow does not require them. 2. If Markdown export is implemented later, grant only a narrowly scoped write capability limited to a dedicated export directory. 3. Avoid granting shell access for document generation or export. Use a purpose-built file-output API instead. 4. Apply explicit path allowlists, deny symbolic-link traversal, reject absolute paths, and prevent overwriting existing files unless the user confirms the action. 5. Require user confirmation before any filesystem operation and clearly display the destination path. 6. Enforce platform-level sandboxing and per-invocation authorization independently of Skill instructions. 7. Add automated checks that reject unused high-risk tool declarations during package review.