T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:16- Finding
Unnecessary Read, Write, and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16-23
Vulnerability Type: Excessive tool permissions that violate least privilege
Risk Level: MediumVulnerable Code
yaml tools: - - read - exec homepage: https://skillhub.cn pricing_tier: "L2-标准级" pricing_model: per_use suggested_price: "19.9 CNY/per_use" tools: ["read", "write", "exec"]Related declarations at lines 345-349 confirm that the Skill is primarily a Markdown and natural-language workflow:
markdown - 本免费版基于Markdown指令运行，无需额外API Key - 所有插画规划通过自然语言交互完成，不上传任何数据 ### 可用性分类 - **分类**: MD+EXEC（纯Markdown指令，部分功能需要exec命令行执行能力） - **说明**: 基于Markdown的AI Skill，通过自然语言指令驱动Agent提供插画规划指导Technical Analysis
The Skill provides natural-language guidance for illustration requirements, style selection, chapter allocation, creative feedback, and project planning. These functions do not require unrestricted access to local files or arbitrary command execution.
Nevertheless, the front matter requests
read,write, andexec. The duplicate and inconsistenttoolsdeclarations also make the effective permission set ambiguous. The only concrete command-related guidance found in the audited file is a suggestion to usepingfor network troubleshooting at line 424; this does not justify general-purpose command execution or workspace write access.This violates the principle of least privilege. Although the audited content does not itself contain a malicious command, granting these unnecessary capabilities increases the damage possible if the Agent is subsequently influenced by malicious user input, untrusted book content, or another prompt-injection source.
Attack Path
- A user or platform loads the Skill and grants the tools declared in its front matter.
- The Agent receives untrusted content, such as a manuscript, project instruction, or other text containing prompt-injection directives.
- The injected content directs the Agent to invoke one of the unnecessarily av ...[truncated 1065 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
read,write, andexecfrom the Skill because its documented illustration-planning functions can operate through natural-language interaction alone. - Retain only one canonical
toolsfield in the YAML front matter to eliminate permission ambiguity. - Reclassify the Skill as Markdown-only rather than
MD+EXEC. - If connectivity diagnostics are genuinely required, replace arbitrary
execwith a narrowly scoped network-diagnostic capability that:- Accepts only validated hostnames or IP addresses.
- Does not invoke a shell.
- Enforces timeouts and output limits.
- Requires explicit user approval before network access.
- Configure the host platform to deny undeclared or unnecessary tool calls and require confirmation for file access and command execution.
- Treat manuscripts and other user-provided content as untrusted data, and prevent instructions embedded in that content from authorizing tool use.
- Remove