T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:5
- Finding
- Excessive Tool Permissions Violate Least-Privilege Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Excessive tool authorization **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Read, Write, Grep, Glob, Bash, WebFetch, WebSearch ``` ### Technical Analysis The skill is intended to analyze freelance job listings and generate proposals. Its documented inputs are pasted text, a local file containing a job description, or a listing URL. These operations may justify narrowly scoped file reading and web retrieval, but the declared permissions also authorize: - `Bash`, which permits arbitrary shell-command execution. - `Write`, which permits modification or creation of local files. - `Grep` and `Glob`, which permit filesystem discovery beyond a user-provided input file. - `WebSearch`, which is not required to retrieve a user-supplied listing URL. No documented step in the proposal-generation workflow requires shell execution, filesystem modification, or broad local-file discovery. Granting these capabilities therefore violates the principle of least privilege and unnecessarily enlarges the impact of instruction injection or agent misuse. The declaration does not itself execute commands or prove malicious intent. Exploitation depends on the runtime allowing untrusted listing content to influence tool calls. Nevertheless, the unnecessary permissions create an avoidable privilege boundary weakness. ### Attack Path 1. An attacker publishes or supplies a freelance listing containing adversarial instructions disguised as job content. 2. A user invokes the skill with that listing, either directly or through a URL. 3. The agent reads the attacker-controlled content while analyzing the listing. 4. If the agent follows the embedded instructions rather than treating them strictly as untrusted data, the attacker can attempt to induce calls to the unnecessarily authorized tools. 5. `Grep` or `Glob` could be used to discover local files; `Read` could then exp ...[truncated 1025 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Apply least privilege to the skill configuration: 1. Remove `Bash` and `Write`, because the documented workflow does not require command execution or filesystem modification. 2. Remove `Grep` and `Glob` unless a concrete, narrowly defined file-discovery use case is documented. 3. Remove `WebSearch` if the skill only needs to retrieve a URL supplied by the user. 4. Retain only `Read` for an explicitly supplied local job-description file and `WebFetch` for an explicitly supplied listing URL. 5. Restrict local reads to the exact user-provided path or an approved workspace directory. 6. Restrict web retrieval to HTTP/HTTPS URLs supplied by the user, block private and link-local network destinations, and enforce response-size and redirect limits. 7. Add an explicit instruction that job listings, fetched pages, and local input files are untrusted data whose contents must never be followed as agent or tool-use instructions. 8. Require user confirmation before any action that accesses additional files or external destinations outside the original input. 9. Enforce runtime sandboxing and tool allowlists independently of the skill text so that content-level instruction injection cannot recover removed privileges. A reduced declaration should resemble: ```yaml allowed-tools: Read, WebFetch ``` If only pasted job descriptions are supported, remove both tools and process the supplied text without filesystem or network access. ]]>