T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:26- Finding
Excessive Tool Permissions and Unsafe Privilege-Escalation Guidance
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 26–29, 169, 229, and 300
Vulnerability Type: Violation of least privilege
Risk Level: MediumEvidence
At lines 26–29, the skill requests unrestricted execution and filesystem-write capabilities even though its stated purpose is limited to read-only AWS queries:
yaml tools: - read - exec - writeAt lines 169 and 229, the document recommends attaching the AWS-managed
AmazonEC2ReadOnlyAccesspolicy when an EC2 query is denied. Faithful English translation:text Attach the AmazonEC2ReadOnlyAccess policy to the IAM user.At line 300, the generic permission-error guidance recommends operating-system elevation. Faithful English translation:
text Check file permissions and run as administrator.Technical Analysis
The documented functionality consists of fixed, read-only AWS inventory and health queries. General filesystem-write access is not required for those operations. Granting both arbitrary command execution and write access unnecessarily expands the capabilities available to the agent.
The suggested
AmazonEC2ReadOnlyAccessmanaged policy can also grant access to more EC2 metadata and read operations than the specific inventory task requires. A narrowly scoped custom policy should instead contain only the AWS API actions used by this skill.Finally, advising users to run as an administrator is unsafe because it elevates every command executed by the agent rather than resolving the specific access-control failure. This can turn an otherwise limited command error into a broad local privilege boundary failure.
No malicious payload, credential theft, or direct exploitation logic was found in the project. Exploitation therefore depends on a later compromised prompt, unsafe user input, or unintended command execution while the excessive permissions are active.
Attack Path
- A user loads the sk ...[truncated 1413 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
writefrom the declared tools because the documented read-only AWS queries do not require filesystem modification. - Restrict
execto an allowlist of the documented AWS CLI commands and arguments. Reject shell metacharacters, command substitution, redirection, and unvalidated user-supplied command fragments. - Replace
AmazonEC2ReadOnlyAccesswith a custom least-privilege IAM policy containing only the required actions, such as:sts:GetCallerIdentityec2:DescribeInstancesec2:DescribeInstanceStatuss3:ListAllMyBucketsrds:DescribeDBInstancescloudwatch:DescribeAlarms
- Scope permissions by account, region, role, and applicable resource conditions where AWS supports such restrictions.
- Remove the recommendation to run as administrator. Diagnose the specific denied file or operation and grant only the minimum required permission.
- Run the agent under a dedicated unprivileged operating-system account and use a restricted working directory.
- Require explicit user confirmation before any operation that changes local configuration, IAM permissions, credentials, or execution privilege.
- Prefer temporary role credentials with short session durations over long-lived IAM user credentials.
- Remove