T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:20- Finding
Excessive Tool Permissions for a Documentation-Only Chat Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-chat
Security checks for vulnerabilities and agentic risk
Overview
The skill is advertised as an agent chat room, but it requests broad local file and command tools and describes generic automation without clear limits.
Review before installing. This artifact does not show malicious code, but if your agent platform honors the declared tools, the skill could give an agent broad access to read, search, modify files, and execute commands even though the advertised use case is only agent chat. Install only in a tightly sandboxed environment or after the publisher narrows the permissions and documents exact command, file, network, and chat-data boundaries.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Documenting system command execution as a capability for a temporary chat-room skill is a major scope escalation. In this context, command execution is not naturally required and could enable arbitrary local actions if an agent or user invokes the skill based on its broader, misleading description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation guidance is overly broad, encouraging use for general AI model calls, orchestration, and chat applications without clear boundaries. Ambiguous routing guidance can cause this skill to be selected in contexts where its permissions and side effects are inappropriate, raising the likelihood of misuse.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The parameter list and result schema describe a generic multi-step pipeline executor rather than a chat-room interface. This kind of interface confusion is dangerous because downstream agents may treat arbitrary task execution as part of a benign chat workflow, enabling unintended actions under an innocuous label.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The FAQ claims features such as member management, offline delivery, and chat history retrieval, but the rest of the file documents a different generic executor model. Inconsistent behavior claims can cause users or agents to make unsafe assumptions about authentication, authorization, and data handling that are not actually implemented or validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is presented as a temporary AI-agent chat tool, but later advertises broad file handling, API integration, and command execution. This mismatch can mislead users or orchestrators into granting the skill more trust and permissions than its stated purpose warrants, increasing the chance of unsafe invocation and privilege misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation mentions file writes, external API calls, and command execution, but does not clearly warn users about the operational and security impact of these side effects. In an agent setting, lack of explicit warnings can lead to silent data modification, data egress, or local command execution under a deceptively benign chat label.
- Content
Static analysis
No suspicious patterns detected.