T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:20- Finding
Excessive Tool Permissions Violate Least-Privilege Principles
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 20–23
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The skill declares unrestricted reading, writing, and command-execution capabilities even though its stated primary purpose is to provide AMap JSAPI integration guidance and examples. Such documentation-oriented functionality does not inherently require general system-command execution or unrestricted filesystem access.
Although the document advises using a sandbox and command allowlist, it does not define or enforce path restrictions, permitted commands, user approval requirements, or other technical controls. Consequently, the declared permissions exceed the minimum capabilities needed for the advertised map-development workflow.
The declaration alone does not prove that commands will be executed maliciously. However, in an agent platform that grants these tools according to the skill manifest, untrusted or adversarial task content could induce the agent to use them outside the legitimate scope of AMap integration.
Attack Path
- A user or untrusted project supplies crafted content disguised as a map-integration, configuration, or troubleshooting request.
- The skill is loaded with
read,write, andexeccapabilities. - The crafted content persuades the agent to inspect files outside the relevant project, write unauthorized files, or execute an unrelated system command.
- Because the skill specifies no enforceable path boundary, command allowlist, or approval gate, the platform may permit the operation under the skill's declared authority.
- The attacker may obtain access to readable local information, modify files writable by the agent process, or execute commands with the privileges of that process.
Impact Assessment
Successful exploitation could provide the attacker with the eff ...[truncated 748 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
execcapability unless a concrete, indispensable map-development operation requires it. - Grant
readandwriteaccess only when needed and restrict both capabilities to the active project directory. - Use read-only access by default and require explicit user confirmation before writing or modifying files.
- If command execution is retained, enforce a small allowlist of commands and fixed argument patterns; never interpolate untrusted user input into shell commands.
- Run all permitted commands in a sandbox with restricted filesystem, process, environment-variable, and network access.
- Require explicit approval before commands with side effects are executed.
- Prevent access to credential stores, SSH material, shell configuration, system directories, and unrelated user files.
- Document the precise reason each tool is required and remove generic capabilities not directly necessary for AMap JSAPI integration.
- Add runtime logging and auditing for filesystem operations and command execution without recording secrets.
- Remove the