T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:13
- Finding
- Overly Broad Docker and Network Shell Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 13–16 **Vulnerability Type**: Excessive shell permissions that violate least privilege **Risk Level**: High ### Vulnerable Code ```yaml shell: - "docker build *" - "docker run *" - "curl *" ``` ### Technical Analysis The skill grants unrestricted argument wildcards to `docker build`, `docker run`, and `curl`. These permissions are substantially broader than the documented workflow, which only requires building the Peen image, starting it with specific mounts and port mappings, and querying known local API endpoints. In particular, `docker run *` allows arbitrary Docker runtime options rather than constraining the image, mount sources, capabilities, network settings, or privilege flags. Depending on the host's Docker authorization model, this could permit sensitive host directories to be mounted into a container or a container to be launched with elevated privileges. Similarly, `curl *` permits requests to arbitrary destinations with arbitrary supported options. An agent could use it to communicate with external systems or transmit data obtained from accessible files, tool output, or Docker-mounted paths. The combination creates a particularly dangerous capability chain: Docker can expand access to host resources, while curl can provide an outbound exfiltration channel. ### Attack Path 1. An attacker manipulates the agent's instructions, or the agent mistakenly constructs a command outside the intended workflow. 2. The agent invokes the permitted `docker run` command with attacker-selected arguments. 3. The command mounts a sensitive host path into a container or requests elevated container permissions, subject to the Docker daemon's effective privileges and security policy. 4. The container reads data from the newly exposed host resource. 5. The agent invokes the unrestricted `curl` permission to send the obtained data to an attacker-controlled ...[truncated 751 chars]
- Remediation
- ## Remediation Suggestions 1. Replace wildcard shell permissions with narrowly scoped wrapper scripts or exact command templates. 2. Restrict Docker execution to the approved Peen image and explicitly allow only the required flags, port mapping, environment file, and workspace/state mounts. 3. Explicitly deny dangerous Docker options, including `--privileged`, arbitrary `--mount` or `-v` sources, host namespaces, added capabilities, device access, Docker socket mounts, and unapproved images or entrypoints. 4. Restrict curl to approved localhost Peen API endpoints, expected HTTP methods, and required headers. Disallow arbitrary URLs, proxy settings, file uploads, redirects to external hosts, and options that read request data from files. 5. Require explicit operator approval for any Docker or network command that differs from the documented setup. 6. Apply defense-in-depth controls outside the skill: use a rootless or tightly isolated Docker environment, restrict outbound network access, avoid exposing the Docker socket, and mount only the intended workspace and state directories. 7. Separate image-building, server-starting, and API-query permissions so each operation receives only the capabilities it requires.