T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:19- Finding
Excessive System Command Execution Capability
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19–22; supporting command-execution and privilege guidance at lines 235–236 and 289–291
Vulnerability Type: Excessive privileges and violation of least privilege
Risk Level: MediumRelevant code snippet:
yaml tools: - read - exec - writeThe supporting documentation declares that the skill can execute system commands in a sandbox and recommends running with administrator privileges when permission errors occur.
Technical Analysis
The skill requests unrestricted
execcapability even though its stated core purpose is extracting, querying, and storing structured knowledge. Those operations can ordinarily be implemented using constrained read and write functions without exposing a general command-execution interface.The document does not define an allowlist of commands, argument-validation rules, working-directory restrictions, environment-variable filtering, timeout enforcement, or explicit user-confirmation requirements. It also provides generic troubleshooting guidance to retry operations with administrator privileges. This can expand the impact of unsafe commands instead of resolving permissions through narrowly scoped access controls.
No executable script or direct malicious command was found in the project. The risk arises from the excessive capability requested by the skill and the unsafe privilege guidance.
Attack Path
- An attacker supplies a document, knowledge entry, or instruction containing content designed to influence downstream command execution.
- The agent loads the skill, which declares access to the general-purpose
exectool. - The agent interprets the attacker-controlled content as requiring a system command.
- Because no command or argument allowlist is defined, the command may execute with all permissions available to the agent process.
- If the command fails because of insufficient permissions, ...[truncated 840 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
exectool from the declared capabilities unless a specific knowledge-management operation demonstrably requires it. - Implement ordinary knowledge capture and storage exclusively through constrained read and write APIs.
- If command execution is essential, replace unrestricted execution with an allowlist of fixed executables and arguments.
- Reject shell metacharacters, command substitution, redirection, untrusted environment-variable expansion, and attacker-controlled executable paths.
- Use a dedicated low-privilege account and a sandbox with a restricted filesystem, disabled network access, resource limits, and a fixed working directory.
- Require explicit user confirmation showing the exact command before any high-impact execution.
- Remove the generic recommendation to run as administrator. Document narrowly scoped permission corrections instead.
- Record commands, arguments, exit status, and authorization decisions in an audit log without exposing secrets.
- Remove the