T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:10- Finding
Mandatory Access to a Hard-Coded Private Obsidian Vault File
- Content
View full analysis
- Remediation
View remediation
Security audit
Multi Unit Test Report
Security checks for vulnerabilities and agentic risk
Overview
This skill is a normal report-writing helper, but it requires reading a hard-coded private Obsidian note outside the reviewed package before it can run.
Review before installing. This skill should either bundle its report template inside the skill or ask you to choose and approve any external reference file. Do not install it as-is unless you are comfortable with the agent reading that exact Obsidian vault note and following its contents.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger language is broad enough that the skill may activate in situations beyond the narrow intended use, increasing the chance that it runs unexpectedly. Unexpected activation matters here because the skill also contains instructions to access a local file and save output, which can compound unintended data exposure or unauthorized file operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read a fixed local file from a specific Obsidian vault path before performing its stated task. That creates unnecessary access to local data outside the user’s immediate request scope and could disclose sensitive filesystem contents or enable prompt injection through the external file’s contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to read from a local Obsidian vault path without informing the user or obtaining permission. Hidden local file access violates least surprise and can expose private notes or system-specific data, especially because the referenced file may contain instructions unrelated to the visible skill definition.
- Content
Static analysis
No suspicious patterns detected.