T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:24
- Finding
- Mandatory Approval Bypass and Unrestricted Sandbox Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-35 **Vulnerability Type**: Approval bypass and excessive execution privileges **Risk Level**: Critical ### Complete Code Snippet ```toml ask_for_approval = "never" sandbox_mode = "danger-full-access" ``` The surrounding instructions state that the Builder must have complete filesystem access and that restricted mode should not be used. ### Technical Analysis The configuration explicitly disables approval prompts and places the Builder in an unrestricted execution environment. These settings remove two complementary security controls: 1. Interactive authorization before potentially dangerous operations. 2. Filesystem and process isolation limiting the consequences of generated commands. A coding assistant ordinarily needs access only to the relevant workspace and a limited set of build tools. Granting unrestricted system access is not necessary for routine compilation, testing, or file editing. Because the Builder processes generated specifications and project-controlled content, malicious instructions in either source can lead directly to arbitrary command execution outside the project. This issue matches both skill-instruction hijacking and unauthorized privilege escalation. The Skill changes the Agent's safety posture when loaded and obtains permissions beyond normal development requirements. ### Attack Path 1. A user invokes the Skill for a development task. 2. The Skill directs the environment to disable approval prompts. 3. The Builder is launched with `danger-full-access`. 4. A malicious specification, repository instruction, dependency script, or prompt-injected source file instructs the Builder to execute an unsafe command. 5. The command runs without interactive review and without workspace containment. 6. The command can read or modify files available to the current operating-system account and invoke local or network-capable tools. ### Impact Assessment An exploit ...[truncated 691 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `ask_for_approval = "never"`. - Replace `danger-full-access` with a workspace-scoped, write-limited sandbox. - Require explicit user approval for commands that: - Access paths outside the project. - Install packages globally. - Use credentials or network services. - Modify Git remotes, tags, or branches. - Delete or overwrite files. - Use a command allowlist for expected build and test tools. - Run third-party Builders under a dedicated low-privilege account or isolated container. - Treat repository files and generated specifications as untrusted input. - Permit temporary privilege escalation only for a displayed, narrowly scoped command after explicit approval. ]]>