T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:28- Finding
Excessive Tool Permissions and Mutating AWS Operations Contradict the Read-Only Scope
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 28–31, 96, 103–110, 158–163, 205, 250, and 329
Vulnerability Type: Excessive permissions and unsafe privilege guidance
Risk Level: MediumVulnerable Code
The skill requests broad execution and filesystem modification capabilities:
yaml tools: - read - exec - writeIt also presents mutating AWS CLI operations:
bash aws ec2 create-vpc-endpoint --vpc-id vpc-PLACEHOLDER \ --service-name com.amazonaws.us-east-1.s3 --route-table-ids rtb-PLACEHOLDERbash aws logs put-retention-policy --log-group-name /aws/lambda/fn --retention-in-days 14bash aws ec2 run-instances --image-id ami-PLACEHOLDER --instance-type t3.small \ --tag-specifications 'ResourceType=instance,Tags=[{Key=Environment,Value=prod}]' aws rds create-db-instance --db-instance-identifier mydb \ --db-instance-class db.t3.micro --engine postgres --allocated-storage 20Technical Analysis
The skill describes itself as supporting read-only resource queries and inventory, and line 250 explicitly states that creation, deletion, and modification operations are unsupported. Nevertheless, it requests the unrestricted
execandwritetools and provides commands that create EC2 instances, RDS databases, and VPC endpoints or modify CloudWatch log-retention policies.Textual requirements for explicit confirmation do not technically enforce authorization. There is no command allowlist, IAM-policy enforcement, argument validation, or execution wrapper shown in the audited project. Consequently, an agent can interpret these examples as executable instructions while operating with the user's configured AWS credentials.
The local filesystem
writecapability is also unnecessary for the declared resource-inventory purpose. In addition, line 329 recommends elevated administrator execution when permissions are insufficient, which conflicts wit ...[truncated 1725 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the
writetool because the declared inventory and recommendation workflow does not require filesystem modification. - Replace unrestricted
execaccess with an allowlisted AWS CLI wrapper that permits only required read operations, such asdescribe-*,get-*, andlist-*. - Use a dedicated AWS IAM role with an explicit read-only policy and deny resource creation, deletion, and modification regardless of prompt instructions.
- Remove executable mutating examples from the read-only skill. If retained as documentation, clearly mark them as non-executable and place them outside agent instructions.
- Enforce approval through a platform-level authorization control rather than relying solely on natural-language confirmation.
- Validate command names and arguments structurally; do not construct shell commands by concatenating user-controlled input.
- Remove the recommendation to run as administrator. Report insufficient permissions and provide least-privilege IAM or filesystem guidance instead.
- Reconcile the documentation so the declared capabilities, requested tools, examples, and operational restrictions consistently describe a read-only skill.
- Add tests that reject all mutating AWS CLI actions, including
create-*,run-*,put-*,modify-*,delete-*, andterminate-*.
- Remove the