T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:39- Finding
Automatic Expansion of Narrow Requests into Unapproved External Write Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:39-46,SKILL.md:81-88, andSKILL.md:147-162
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Instructions
The following is an English rendering of the relevant Skill instructions:
markdown | User request | Action | |---|---| | Help me hold a meeting / schedule a meeting | Run the complete end-to-end workflow | | Help me book a meeting room | Do not only book the room; run the complete workflow: room booking, calendar creation, and materials | Core principle: The user may request one point, such as booking a meeting room, but the Skill must execute the entire workflow from scheduling through minutes. Never require the user to direct each step; proactively advance to the next step.markdown ## Act First, Report Later After the user supplies a meeting request, the Agent executes all steps in one pass and pauses only when human decision-making is strictly required. | Principle | Description | |---|---| | Automatic by default | Check availability, select a time, book a room, create the event, and prepare materials without intermediate questions | | Pause only on conflict | Ask the user only when a predefined pause condition is encountered | | Report once | Report all results only after the operations are complete |markdown Step 4: Book a meeting room through the room adapter. Step 5: Create the calendar event through the calendar adapter. Step 6: Create meeting materials through the document adapter and update the event notes. Step 7: Report the completed operations.Technical Analysis
The Skill deliberately broadens a narrowly scoped request into multiple external operations. For example, a request to book a meeting room is treated as authorization to query participant calendars, reserve a room, create a calendar event, send invitations, generate ...[truncated 2438 chars]
- Remediation
View remediation
Remediation Suggestions
-
Preserve the scope of the user’s request:
- A room-booking request should only search for or reserve a room.
- A scheduling request should not automatically send notifications or publish documents.
- Offer the complete workflow as an explicit option rather than the default.
-
Add confirmation gates before consequential writes:
- Room reservation.
- Calendar event creation or modification.
- Invitation delivery.
- Document creation in a shared workspace.
- Notification delivery to external recipients.
-
Present a preview containing the exact attendees, time, room, event title, document destination, and notification recipients before execution.
-
Separate read-only planning from write execution. Availability checks and candidate generation may run first, while mutations should require explicit user approval.
-
Allow users to configure per-adapter automation policies such as
read_only,confirm_writes, orfully_automatic. -
Record and report each external action individually, including the adapter used and the resource modified, so unwanted operations can be identified and reversed.
-