T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:5
- Finding
- Unnecessary Bash Permission Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Read, Write, Grep, Glob, Bash, WebFetch, WebSearch ``` ### Technical Analysis The skill grants access to the general-purpose `Bash` tool even though its documented SEO workflow does not identify any operation that requires shell command execution. Web research can be performed with `WebFetch` and `WebSearch`, keyword files can be processed with `Read`, and generated articles can be stored with `Write`. A general-purpose shell substantially expands the skill's authority. If untrusted keyword-file content, search results, or fetched pages influence agent behavior through prompt injection, the unnecessary shell capability could turn an instruction-level compromise into command execution. The permission declaration does not itself execute a command, and successful exploitation remains dependent on the host agent accepting malicious instructions and allowing the Bash invocation. Nevertheless, exposing a command-execution channel without a documented operational need violates least-privilege principles. ### Attack Path 1. An attacker places prompt-injection instructions in a webpage likely to appear in the SEO research results or in a user-supplied batch keyword file. 2. The skill reads or fetches the attacker-controlled content as part of its documented workflow. 3. The malicious content instructs the agent to disregard the SEO task and invoke `Bash`. 4. Because `Bash` is included in `allowed-tools`, the agent may attempt to run attacker-selected shell commands. 5. If the runtime does not provide an additional approval or sandbox boundary, those commands execute with the operating-system privileges and filesystem access of the agent process. ### Impact Assessment Potential impact includes reading or modifying files accessible to the agent process, executing local programs, al ...[truncated 423 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `Bash` from `allowed-tools` because no documented phase requires shell execution. - Retain only the minimum required capabilities, such as `Read`, `Write`, `WebFetch`, and `WebSearch`. - Restrict reads to the explicitly supplied keyword file and project-owned resources. - Restrict writes to a dedicated directory such as `output/`, rejecting path traversal and absolute paths. - Treat search results, fetched pages, and keyword files as untrusted data rather than executable instructions. - If shell access later becomes necessary, replace unrestricted Bash access with a narrowly scoped operation using fixed commands, validated arguments, an isolated working directory, and explicit user approval. - Run the skill in a sandbox with limited filesystem permissions, network egress controls, resource limits, and no access to credentials. ]]>