T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:5- Finding
Excessive and Inconsistent Tool Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5 and 17-20
Vulnerability Type: Excessive tool permissions and least-privilege violation
Risk Level: MediumVulnerable Code
yaml allowed-tools: read execyaml tools: - exec - read - writeTechnical Analysis
The skill requests shell execution and filesystem access even though its stated purpose is to generate Bilibili titles, descriptions, and tags through the host language model. The document itself later describes the skill as pure Markdown whose core functionality does not require command execution.
These permissions exceed the legitimate requirements of content generation. The declarations are also inconsistent:
writeis present undertoolsbut absent fromallowed-tools. Depending on how a host resolves conflicting metadata, it could grant the broader permission set.The declarations do not independently execute malicious operations, and the audited file contains no instruction that actively abuses the permissions. Nevertheless, granting them creates an avoidable privilege boundary failure: malicious user content, indirect prompt injection, or unintended agent behavior could potentially invoke tools that the skill does not need.
Attack Path
- A host loads
SKILL.mdand interprets either or both tool declarations. - The host grants the skill
exec,read, and potentiallywritecapabilities. - Attacker-controlled content or an indirect prompt injection influences the agent while the skill is active.
- The influenced agent invokes the unnecessarily available tools.
- Subject to host sandboxing and process permissions, the invocation could read accessible files, modify writable files, or execute local commands.
This is a conditional exploitation path because no direct tool-abuse instruction was identified in the audited skill.
Impact Assessment
Potential privileges include command ...[truncated 490 chars]
- A host loads
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritebecause the documented content-generation functionality can be performed directly by the language model. - Declare an empty tool set, or omit tool permissions entirely if supported by the skill format.
- Maintain one authoritative permission field rather than conflicting
allowed-toolsandtoolsdeclarations. - If a future feature genuinely requires a tool, grant only that specific tool and constrain its allowed operations, paths, arguments, and execution environment.
- Enforce host-side sandboxing, explicit user approval for sensitive operations, and denial by default for undeclared tools.
- Add automated manifest validation to reject inconsistent permission declarations and flag tools that are not justified by documented functionality.
- Remove