T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:23- Finding
Excessive Command-Execution Permission
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–26
Vulnerability Type: Violation of least privilege through unnecessary command-execution capability
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The skill is designed to generate REST API documentation, a task that does not inherently require operating-system command execution. Nevertheless, its metadata grants the
exectool alongside file read and write capabilities.No concrete workflow in the reviewed file requires
exec. The only shell example validates a user-configured environment variable and does not establish a legitimate runtime need for arbitrary command execution. Granting this capability therefore expands the skill's authority beyond its documented purpose and violates the principle of least privilege.In an agent environment where skill input, API specifications, or referenced documents are untrusted, malicious instructions embedded in that content could attempt to induce the agent to invoke
exec. Whether exploitation succeeds depends on the host agent's instruction hierarchy, tool controls, sandboxing, and approval requirements; the declaration alone does not prove that commands are automatically executed.Attack Path
- A user activates the skill to process an API specification or documentation request.
- An attacker supplies or influences content within the input, such as an API description containing embedded instructions.
- The agent interprets the attacker-controlled content as an instruction to execute a local command.
- Because the skill declares access to
exec, the agent may invoke the command if the hosting platform does not enforce sufficient isolation or confirmation. - The command executes with the operating-system privileges and filesystem access available to the agent process.
Impact Assessment
Successful exploitation could provide command execution within the agent' ...[truncated 561 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execfrom the declared tool list because the documented API-writing workflow does not require shell access:
yaml tools: - read - write- If documents are generated entirely in the conversation, remove file permissions as well and declare no tools.
- If command execution is later shown to be essential, replace unrestricted execution with a narrowly scoped interface that:
- permits only explicitly documented commands;
- uses fixed executable paths and fixed argument structures;
- rejects shell metacharacters and user-controlled command strings;
- runs in a restricted sandbox with minimal filesystem and network access;
- excludes secrets from the process environment;
- applies execution time and resource limits; and
- requires explicit user confirmation before each invocation.
- Treat API specifications, callback values, templates, and other supplied content as untrusted data rather than executable instructions.
- Add automated validation to ensure the skill's declared tools remain aligned with its documented functionality.
- Remove