T05 · Unauthorized Access and Privilege Escalation
- Location
.claude/settings.local.json:3- Finding
Project Configuration Grants Unnecessary External File Access and Command Execution
- Content
View full analysis
Vulnerability Details
File Location:
.claude/settings.local.json, lines 3–6
Vulnerability Type: Excessive project-local agent permissions
Risk Level: MediumComplete Code Snippet:
json "allow": [ "Read(//Users/yanhuijiang/Desktop/skill打包/**)", "Bash(zip -r xfyun-image-understanding.zip xfyun-image-understanding/)" ]Technical Analysis
The project-local Claude configuration pre-authorizes access to a developer-specific directory outside the project and permits execution of a packaging command. These capabilities are unrelated to the Skill's declared purpose of reading a user-selected image and submitting it to the iFlytek image-understanding service.
The external recursive read rule violates least privilege because it crosses the project boundary and may suppress the normal approval prompt for files under that directory. The Bash rule also expands the agent's execution permissions even though packaging is not required at runtime.
Exploitation depends on a compatible agent environment loading and enforcing this project-local configuration. The configuration does not itself read files or run the command, but it removes an authorization barrier if a later agent action, malicious instruction, or prompt-injected input requests one of the allowed operations.
Attack Path
- A user opens or runs the project in an environment that honors
.claude/settings.local.json. - The environment activates the pre-authorized external read and Bash rules.
- An attacker-controlled instruction, prompt-injected document, or unintended agent action requests access to a file beneath
/Users/yanhuijiang/Desktop/skill打包/. - The read proceeds without the approval that would otherwise be required.
- Retrieved data could subsequently be disclosed through agent output or another permitted operation.
Alternatively, an agent can invoke the pre-authorized archive command without a fresh approval prompt, ...[truncated 1133 chars]
- A user opens or runs the project in an environment that honors
- Remediation
View remediation
Remediation Suggestions
- Remove
.claude/settings.local.jsonfrom the distributed Skill because these development and packaging permissions are not required at runtime. - Remove the recursive external read rule. Require explicit user approval for each user-selected image or constrain access to a narrowly defined project-relative input directory.
- Remove the pre-authorized Bash packaging command. Perform release packaging outside the runtime Skill configuration or require an explicit approval when packaging is requested.
- Add
.claude/settings.local.jsonto.gitignoreor the package exclusion rules so developer-specific local permissions are not shipped. - Review project-local agent settings during release checks and reject absolute paths, recursive external-directory access, and runtime-irrelevant command permissions.
- Rotate or inspect potentially sensitive material in the exposed directory if the Skill has already been used in an environment where untrusted instructions could trigger agent tool calls.
- Remove