T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- exchanges/aerodrome.md:21
- Finding
- Skill Directs the Agent to Access Files Outside the Packaged Project<![CDATA[ ## Vulnerability Details **File Location**: `exchanges/aerodrome.md`, lines 21–31 **Vulnerability Type**: Least-privilege violation through out-of-scope filesystem access **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Source Of Truth When behavior is unclear, inspect these local sources before answering: - Production API: `https://api.superior.trade` - API: `/Users/trmaphi/sources/superior-trade/api` - Freqtrade fork: `/Users/trmaphi/sources/superior-trade/freqtrade-upstream` - Aerodrome exchange wrapper: `freqtrade-upstream/freqtrade/exchange/aerodrome.py` - Aerodrome CCXT implementation: `freqtrade-upstream/ccxt/python/ccxt/aerodrome.py` - API validation: `api/src/freqtrade/schema.ts` - API config padding: `api/src/freqtrade/configurationsOp.ts` ``` ### Technical Analysis The Skill instructs the Agent to inspect absolute developer-machine paths and repository files that are not included in the packaged project. These paths are outside the declared Skill boundary and are not required to consume the documented Superior Trade API. If those paths exist on the execution host, following the instruction could cause the Agent to read proprietary source code, local configuration, comments, repository metadata, or other information that the user did not authorize it to access. The relative paths also implicitly assume access to an external monorepository. This expands the filesystem trust boundary beyond the minimum privileges needed for the Skill’s declared backtesting and deployment functionality. Required behavioral documentation should instead be packaged with the Skill or obtained from an approved, version-pinned public specification. ### Attack Path 1. A user invokes the Aerodrome Skill for a behavior that is unclear or not fully documented. 2. The Skill instructs the Agent to treat local external repositories as the source of truth. 3. The Agent attempts to read `/Users/trmaphi/sources/superior-trade/api`, `/Users/trmaphi/so ...[truncated 1062 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all absolute developer-machine paths and references to unpackaged local repositories. 2. Package the required API schemas and exchange behavior documentation within the Skill directory. 3. If external documentation is necessary, use an official HTTPS endpoint pinned to a specific version or commit. 4. Add an explicit rule that the Agent must not inspect files outside the Skill directory unless the user separately identifies and authorizes those files. 5. Treat unavailable implementation details as an unsupported condition rather than searching the host filesystem. 6. Review the rest of the documentation for internal monorepository paths and replace them with packaged or public references. ]]>