T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:27- Finding
Excessive Command-Execution and Filesystem Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:27-30,SKILL.md:259,SKILL.md:284, andSKILL.md:323
Vulnerability Type: Excessive tool permissions and unsafe privilege-escalation guidance
Risk Level: MediumVulnerable Code
SKILL.md:27-30:yaml tools: - read - exec - writeSKILL.md:259states that the Skill can execute system commands in a sandbox and collect their results.SKILL.md:284andSKILL.md:323provide the following troubleshooting guidance:text Insufficient permissions | The current user lacks read/write permissions | Check file permissions and run as administratorTechnical Analysis
The Skill's declared purpose is to assess documents, extract their core logic, and identify ambiguity, contradictions, and undefined terms. Its primary workflow therefore requires access to document content and the ability to return an analysis. Generic system-command execution and unrestricted filesystem writing are not inherently necessary for these functions.
Declaring both
execandwriteviolates the principle of least privilege by granting the agent capabilities beyond the minimum requirements of the documented task. The Skill does not define:- An allowlist of permitted commands.
- Restrictions on command arguments.
- Approved input and output directories.
- Filesystem path validation or canonicalization.
- Enforcement preventing writes outside a designated workspace.
- A mandatory user-confirmation boundary for command execution.
- Technical sandbox controls beyond the unsupported assertion that commands run in a sandbox.
The troubleshooting guidance compounds this exposure by recommending administrator execution whenever permissions are insufficient. It does not require the user or agent to determine why access was denied, confirm that elevated access is necessary, or limit the elevated operation to a specific resource.
No malicious comma ...[truncated 2212 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
execandwritefrom the declared tool set if the Skill only analyzes text and returns an in-memory response:yaml tools: - read -
If file output is an essential feature, replace generic write access with a narrowly scoped output mechanism that:
- Writes only to a designated workspace directory.
- Rejects absolute paths and parent-directory traversal.
- Resolves and validates canonical paths before access.
- Prevents overwriting existing files unless the user explicitly approves it.
- Uses restrictive permissions for newly created files.
-
If command execution is demonstrably required for parsing particular document formats:
- Use a dedicated parser instead of a shell whenever possible.
- Define an explicit executable allowlist.
- Pass arguments as structured arrays rather than concatenated shell strings.
- Never interpolate document content directly into commands.
- Disable shell expansion and command substitution.
- Enforce execution time, memory, network, and output-size limits.
- Run commands in an isolated, non-privileged sandbox.
- Require explicit user approval showing the exact executable and arguments.
-
Remove the blanket recommendation to run as administrator. Replace it with guidance to:
- Verify the requested path and operation.
- Confirm that access is legitimately required.
- Correct narrowly scoped ownership or permissions where appropriate.
- Abort safely when access is unavailable.
- Use elevation only as an exceptional, user-approved action with a clearly explained scope.
-
Treat all analyzed documents as untrusted data. Explicitly instruct the agent not to follow commands, tool requests, or behavioral instructions embedded in document content.
-
Add tests confirming that untrusted document text cannot cause command execution, writes outside the approved workspace, or ...[truncated 33 chars]
-