T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:5
- Finding
- Excessive Tool Permissions Violate Least-Privilege Requirements## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Excessive agent tool permissions **Risk Level**: Medium ```yaml allowed-tools: Read, Write, Edit, Grep, Glob, Bash ``` ### Technical Analysis The Skill is designed to generate email marketing content and save platform-ready Markdown or CSV files. This workflow requires a narrowly scoped output-writing capability, but the configuration also grants unrestricted shell execution through `Bash` and broad file discovery and access through `Read`, `Grep`, and `Glob`. The documented workflow does not identify a legitimate need to execute operating-system commands, inspect arbitrary local files, or search the surrounding filesystem. These permissions therefore exceed the Skill's functional requirements and violate the principle of least privilege. No command invoking these tools, malicious script, credential-access instruction, or active exploitation mechanism was found in the audited file. Exploitation would require the Agent to follow attacker-controlled or otherwise untrusted instructions supplied through the business description, campaign content, or surrounding prompt context. ### Attack Path 1. A user or external content source supplies a malicious business description or contextual instruction when invoking the Skill. 2. The injected content directs the Agent to perform operations unrelated to email generation, such as searching for local files, reading sensitive data, or executing a shell command. 3. Because `Read`, `Grep`, `Glob`, and `Bash` are explicitly allowed, the Agent may attempt those operations instead of remaining confined to content generation. 4. If the runtime does not apply additional sandboxing or path restrictions, the operation could access files outside the intended output directory or execute commands with the Agent process's operating-system privileges. 5. Data exposed by those operations could subsequently be incorporated i ...[truncated 778 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash`, `Read`, `Grep`, and `Glob` from `allowed-tools` because the documented email-generation workflow does not require them. 2. Retain only the minimum file-writing or editing capability necessary to produce campaign output. 3. Restrict all output operations to a dedicated directory such as `output/email-sequence/`. 4. Deny path traversal, absolute paths, symbolic-link escapes, and access to files outside the designated output directory. 5. If input files must be supported later, grant read access only to explicitly selected files rather than the entire workspace. 6. Treat business descriptions and other user-supplied campaign content as untrusted data, and prohibit instructions embedded in that content from expanding tool usage or changing the Skill's purpose. 7. Apply runtime sandboxing and command allowlisting if shell access is ever introduced for a documented requirement. 8. Add tests confirming that the Skill can complete every supported sequence type without shell execution or access to unrelated files.