T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:26- Finding
Excessive Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 26–29
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: Mediumyaml tools: - read - exec - writeTechnical Analysis
The Skill requests unrestricted file-reading, file-writing, and command-execution tools even though its stated primary purpose is to provide social-network operations such as profile management, friend management, messaging, group browsing, and feed retrieval.
These general-purpose system capabilities are not shown to be necessary for those operations. The document also advertises generic file processing and system-command execution at lines 290–302, but it provides no executable allowlist, argument schema, path restrictions, sandbox policy, or authorization checks. No implementation is included that could demonstrate enforcement of the stated security controls.
This violates the principle of least privilege. In an agent environment that grants the declared tools, malicious or untrusted input could potentially influence the agent to perform local operations outside the legitimate scope of the Skill.
Attack Path
- An agent platform loads the Skill and grants its declared
read,write, andexeccapabilities. - The agent processes attacker-controlled content, such as a user request, private message, group post, or feed entry.
- The content instructs or persuades the agent to invoke one of the broadly authorized tools.
- Because the Skill defines no command allowlist, path boundary, or argument-validation mechanism, the agent may read an unrelated local file, overwrite accessible data, or execute an unrelated system command.
- Any resulting data could then be exposed through the agent's response or transmitted using the Skill's social or messaging functionality, subject to the host platform's actual controls.
The package contains documentation only, so this p ...[truncated 1052 chars]
- An agent platform loads the Skill and grants its declared
- Remediation
View remediation
Remediation Suggestions
- Remove the generic
read,write, andexecpermissions unless each capability is strictly necessary and supported by an auditable implementation. - Replace them with narrowly scoped tools dedicated to profile, friend, message, group, and feed operations.
- If command execution is unavoidable:
- Allow only a fixed executable and an explicit set of subcommands.
- Validate every argument against a strict typed schema.
- Reject shell metacharacters and prohibit shell-string construction.
- Execute commands without invoking a shell.
- Run commands in a restricted sandbox with minimal filesystem and network access.
- If file access is required:
- Restrict access to a dedicated application directory.
- Resolve and canonicalize paths before access.
- Reject absolute paths, traversal sequences, and symbolic-link escapes.
- Separate read and write authorization.
- Treat private messages, group content, feed entries, and other remote content strictly as untrusted data. Do not interpret such content as tool instructions.
- Require explicit user confirmation before any security-sensitive file or command operation.
- Document the exact API endpoint, authentication model, required permissions, and enforced security boundaries so the claimed controls can be independently verified.
- Remove the generic