T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL_CN.md:1
- Finding
- Overly Broad Shell and Network Tool Permissions## Vulnerability Details **File Location**: `SKILL_CN.md:1-6` **Vulnerability Type**: Excessive tool permissions that violate least privilege **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml --- name: hybrid-deep-search description: Hybrid deep search using Brave API and OpenAI Codex with automatic routing argument-hint: [search query] [--mode quick|codex|auto] [--focus web|academic|news] allowed-tools: Bash(*:web_search), Bash(*:curl), Bash(*:python3) --- ``` ### Technical Analysis The skill grants access to general-purpose `curl` and Python execution through the Bash tool. These permissions are substantially broader than those required by the implemented query-routing behavior. The audited scripts do not invoke `curl`, and both search methods in `scripts/deep_search.py` return simulated results rather than performing network requests. General-purpose Python execution can run arbitrary local code, while `curl` can communicate with arbitrary network destinations. Consequently, the declared tool policy does not enforce least privilege or restrict operations to the stated search functionality. No malicious use of these permissions was found in the supplied package. The risk arises from the unnecessary capability exposed if skill instructions, arguments, or later modifications cause unintended tool invocation. ### Attack Path 1. A user loads or invokes the skill, making its declared Bash tool capabilities available. 2. Attacker-controlled or otherwise untrusted content influences a tool invocation. 3. The broad `Bash(*:python3)` permission is used to execute general-purpose Python code, or `Bash(*:curl)` is used to contact an arbitrary external destination. 4. Code running under the agent's operating-system identity accesses resources available to that identity. 5. Accessible data could be processed locally or transmitted through the permitted network tool. This path depends on an attacker obtaining ...[truncated 682 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash(*:curl)` because the current implementation does not use it. 2. Replace unrestricted Python execution with a narrowly scoped permission that permits only the packaged entry point and expected arguments. 3. Permit only the specific search tool needed for the advertised functionality. 4. If direct HTTP access is added later, restrict requests to reviewed HTTPS endpoints and enforce destination allowlists, timeouts, response-size limits, and redirect controls. 5. Run the skill in a sandbox with minimal filesystem access, no unnecessary credentials, and restricted outbound networking. 6. Keep tool declarations synchronized with actual implementation so unused capabilities are removed during review.