T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:22- Finding
Excessive Execution and File-Write Permissions in a Documentation-Only Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
agent-framework-azure-ai-py
Security checks for vulnerabilities and agentic risk
Overview
The skill claims to be documentation-only but requests execution and write authority and gives broad development-operation instructions without clear limits.
Review this skill before installing. It does not show evidence of a malicious payload, but it asks for command execution and file-writing authority while presenting itself as documentation-only. Only use it in a constrained workspace, avoid exposing cloud credentials unless necessary, and require explicit approval for any command execution or file modification.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill presents itself as documentation-only, but elsewhere declares powerful capabilities like exec, write, code analysis, and operational workflows. This mismatch is dangerous because users or orchestration systems may grant trust, lower scrutiny, or auto-invoke the skill under the assumption that it is passive documentation when it actually describes active behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented workflow expands from Azure AI Foundry guidance into generic code reading, editing, refactoring, testing, and validation. That scope expansion breaks least surprise and can cause an agent or user to apply the skill to arbitrary development tasks with file and execution access that are unrelated to the advertised purpose.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The feature list advertises automated execution, file handling, API integration, and command execution despite the earlier documentation-only framing. In a skill ecosystem, this inconsistency can be used to mask risky capabilities behind a benign label, increasing the chance of unsafe invocation and privilege misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance is broad enough to match many generic AI-assistance requests, such as model calling, conversations, agent orchestration, and LLM application use. Overbroad routing criteria can cause the skill to trigger in contexts where its tools and instructions are unnecessary or risky, especially given the declared read/exec/write capabilities.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Telling users to invoke the skill in any AI Agent conversation makes the skill effectively general-purpose despite its claimed specialized role. In a tool-enabled agent platform, ambiguous invocation guidance increases unnecessary exposure of powerful capabilities and encourages use outside safe, intended boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises file writing, external API integration, and command execution in its functional description without prominent upfront warning in the summary/manifest. This is risky because users and orchestrators may not understand that enabling the skill implies actions beyond passive documentation, leading to unsafe consent and authorization decisions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Introducing command execution in a skill whose stated purpose is documentation and guidance unnecessarily increases operational risk. Even without explicit malicious commands, normalizing command execution broadens the attack surface for prompt injection, misuse, or accidental destructive actions in environments that expose shell access.
- Content
Static analysis
No suspicious patterns detected.