T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Overly Broad Tool Permissions Violate Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13`; duplicated in `skills/SKILL.md:13` **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash(npm:*) Bash(npx:*) Bash(openclaw:*) Bash(curl:*) Read Write WebFetch ``` ### Technical Analysis The skill declares access to package execution through `npm` and `npx`, arbitrary outbound requests through `curl` and `WebFetch`, unrestricted file reading and writing, and broad OpenClaw command execution. These capabilities materially exceed the permissions required for the declared workflow, which is primarily browser automation against `https://chat.deepseek.com`. In particular: - `npx` can download and execute third-party packages. - `npm` can execute package lifecycle scripts and locally defined scripts. - `curl` and `WebFetch` can communicate with destinations unrelated to DeepSeek. - `Read` may expose local configuration, credentials, tokens, and user data. - `Write` can modify files outside the narrow requirements of storing a screenshot. - `Bash(openclaw:*)` permits a broad set of OpenClaw operations rather than only the required browser and messaging actions. No malicious use of these permissions was identified in the reviewed files. However, exposing all of them to an instruction-driven skill creates an unnecessary privilege boundary failure and increases the consequences of malicious input, compromised external content, or agent misinterpretation. The same permission declaration is included in both copies of the skill documentation, so either packaged entry point retains the excessive authority. ### Attack Path 1. A user, external page, or other untrusted source supplies instructions while this skill is active. 2. The agent interprets those instructions as requiring an allowed command or filesystem operation. 3. The broad permission declaration allows the agent to invoke `npx`, `npm`, `curl`, `WebFetch`, `Read`, `Write`, ...[truncated 891 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove capabilities that are not necessary for the browser workflow: - Remove `Bash(npm:*)` and `Bash(npx:*)`. - Remove `Bash(curl:*)` and `WebFetch` unless a separately reviewed network workflow requires them. - Remove unrestricted `Read` and `Write`. 2. Replace broad `Bash(openclaw:*)` access with narrowly scoped browser and messaging operations. 3. If screenshot storage is required, grant write access only to a dedicated directory and grant read access only to the generated screenshot. 4. Restrict outbound browser navigation to approved DeepSeek origins, including: - `https://chat.deepseek.com/` - Any explicitly documented authentication origin required for QR login. 5. Require explicit user confirmation before transmitting screenshots, questions, or responses through messaging channels. 6. Apply the corrected permission declaration to both `SKILL.md` and `skills/SKILL.md` so the duplicate packaged definitions remain consistent. ]]>