T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:25
- Finding
- Blanket Vault Enumeration and Excessive Secret Injection into Child Processes## Vulnerability Details **File Location**: `SKILL.md:25-32`, `SKILL.md:68-78`, and `SKILL.md:183-185` **Vulnerability Type**: Excessive credential access and violation of least privilege **Risk Level**: High ### Vulnerable Code `SKILL.md:25-32`: ```markdown **Before asking the user for any credential, always check R4 first.** ### List all environment variables ```bash r4 vault list ``` Lists all project environment variables as a key-value table. Keys are in `SCREAMING_SNAKE_CASE` format. ``` `SKILL.md:68-78`: ```markdown r4 run -- <command> ``` Executes a command with all vault secrets injected as environment variables. This is the preferred way to run scripts that need access to secrets. Examples: ```bash r4 run -- node deploy.js r4 run -- docker compose up r4 run --prefix R4 -- ./start.sh ``` `SKILL.md:183-185`: ```markdown - **ALWAYS** use `r4 run` to inject secrets as environment variables when running commands - **ALWAYS** use `r4 vault get <KEY>` to retrieve individual values programmatically - **ALWAYS** check R4 vault before asking the user for any credential or secret ``` ### Technical Analysis The skill instructs agents to inspect the credential vault preemptively and recommends `r4 run`, which injects **all** available vault secrets into a selected process. This design violates the principle of least privilege because a command that requires one credential receives every credential shared with the project. Environment variables are accessible to the launched process and may also be inherited by its descendants. Consequently, a compromised dependency, malicious script, diagnostic utility, build hook, or otherwise untrusted command launched through `r4 run` can inspect and disclose credentials unrelated to its legitimate task. The mandatory wording—“ALWAYS check R4” and “ALWAYS use `r4 run`”—makes exposure systematic rather than exceptional. Although the d ...[truncated 1897 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the blanket requirement to inspect the vault before every credential-related interaction. Require a demonstrated, task-specific need before accessing a secret. 2. Do not inject the full vault into child processes. Replace `r4 run` with an interface that accepts an explicit allowlist of required keys. 3. Retrieve only individually named secrets and expose them only to the exact process that requires them. 4. Require explicit user confirmation before accessing highly privileged credentials or supplying credentials to unfamiliar commands. 5. Add a trust assessment that prohibits secret injection into downloaded scripts, package lifecycle hooks, unreviewed binaries, or commands capable of executing third-party code. 6. Prevent unnecessary inheritance by subprocesses and remove secrets from the environment immediately after the intended operation. 7. Use narrowly scoped, short-lived credentials where supported, with separate credentials for development, deployment, and production. 8. Redact secrets from stdout, stderr, crash reports, telemetry, shell tracing, and command logs. 9. Audit and alert on vault access, full-environment injection, and unusual credential retrieval patterns. 10. Update the skill documentation so least-privilege retrieval is the mandatory default and full-vault injection is prohibited.