T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:5
- Finding
- Unnecessary Shell Capability Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Read, Edit, Write, Glob, Grep, Bash, AskUserQuestion, mcp__claude_ai_Actions_Team__listActions, mcp__claude_ai_Actions_Team__listProjects ``` ### Technical Analysis The skill grants access to the `Bash` tool even though its documented workflow only requires reading, searching, creating, and editing journal files; asking the user questions; and querying two Brain MCP endpoints. No instruction in the reviewed skill requires shell command execution. This violates the principle of least privilege. The skill processes potentially untrusted content from journals, `inbox.md`, and externally supplied Brain tasks and projects. If any of that content contains prompt-injection instructions that influence the agent, the unnecessary `Bash` permission provides a command-execution channel that is substantially more powerful than the legitimate journaling operations require. The permission alone does not demonstrate that malicious commands are currently executed. The risk arises because it unnecessarily expands the impact of a successful prompt-injection or agent-control failure. ### Attack Path 1. An attacker places adversarial instructions in content the skill is expected to load, such as a shared journal entry, inbox item, Brain task, or Brain project. 2. The user invokes the morning skill. 3. The skill reads the attacker-controlled content as part of its normal context-loading process. 4. The injected content attempts to persuade the agent to invoke `Bash`. 5. Because `Bash` is explicitly permitted, a successful instruction injection could cause local shell commands to run with the privileges of the OpenClaw process. This path depends on the agent accepting the injected instruction and on an attacker being able to influence one of the loaded data sources. ### Impact Assessment Successful ex ...[truncated 667 chars]
- Remediation
- ## Remediation Suggestions Remove `Bash` from the `allowed-tools` declaration and retain only the tools required by the documented workflow: ```yaml allowed-tools: Read, Edit, Write, Glob, Grep, AskUserQuestion, mcp__claude_ai_Actions_Team__listActions, mcp__claude_ai_Actions_Team__listProjects ``` Apply the following additional hardening measures: 1. Treat journal, inbox, task, and project text strictly as untrusted data rather than executable instructions. 2. Require explicit user confirmation before performing destructive or broad file modifications. 3. Constrain file operations to the documented journal and inbox paths where the host supports path-based permissions. 4. If shell access becomes necessary in a future version, document the exact use case and replace unrestricted shell access with a narrowly scoped tool or fixed command allowlist. 5. Add regression checks ensuring that new tool permissions correspond to a documented and necessary workflow step.