T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:69
- Finding
- Overly Broad Secret Scan May Expose Unrelated Workspace Credentials## Vulnerability Details **File Location**: `SKILL.md`, line 69 **Vulnerability Type**: Excessive access to unrelated workspace files and sensitive output exposure **Risk Level**: Medium **Vulnerable Code**: ```bash grep -RInE 'password|passwd|secret|token|api[_-]?key|BEGIN .*PRIVATE|private[_-]?key|cookie|credential' SKILL.md . 2>/dev/null || true ``` ### Technical Analysis The command recursively searches both `SKILL.md` and the entire current directory (`.`). The stated purpose is to validate the skill source before publication, but recursively inspecting the surrounding workspace exceeds what is necessary when only the target skill file needs review. When a matching expression is found, `grep` prints the complete matching line by default. Consequently, unrelated configuration files, environment files, source code, backups, or credential stores within the working directory may have their sensitive values written to terminal output, agent context, execution logs, or retained conversation history. The `2>/dev/null` redirection suppresses permission and traversal errors, reducing visibility into which locations could not be scanned. The trailing `|| true` also forces a successful command status, potentially concealing operational failures. These constructs are not direct exploitation mechanisms, but they make the scan less transparent. ### Attack Path 1. A user invokes the documented skill-publishing workflow from a repository or workspace root. 2. The agent executes the recommended secret-scanning command. 3. The recursive `.` operand causes `grep` to inspect files unrelated to the target `SKILL.md`. 4. An unrelated file contains a line matching a term such as `token`, `password`, `cookie`, or `private_key`. 5. `grep` prints the complete matching line, potentially including the actual secret value. 6. The exposed value becomes visible in terminal output, agent context, audit logs, or conversation records. No networ ...[truncated 788 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict the scan to the intended skill file rather than recursively scanning the current workspace: ```bash grep -nE 'password|passwd|secret|token|api[_-]?key|BEGIN .*PRIVATE|private[_-]?key|cookie|credential' -- SKILL.md || true ``` 2. Avoid printing complete matching lines when they may contain secret values. Prefer a dedicated secret scanner that supports redaction, or report only filenames, line numbers, and rule identifiers. 3. If directory scanning is genuinely required, require explicit user approval and use a narrowly defined path with exclusions for files such as `.env`, credential stores, private keys, build artifacts, dependency directories, and version-control metadata. 4. Run the scan with the minimum necessary filesystem permissions and from a dedicated staging directory containing only the publication artifact. 5. Do not suppress all errors unconditionally. Surface inaccessible paths and scanner failures so the user can determine whether the review was complete. 6. Require manual review of sanitized findings before any public gist, repository, or marketplace upload.