T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:20- Finding
Excessive File-System and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:20-23
Supporting Locations:SKILL.md:202,SKILL.md:209-218,SKILL.md:231-233
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The Skill declares file-reading, file-writing, and arbitrary command-execution tools even though its stated purpose is to locate and book local painter services through an external API. The documentation does not establish a legitimate need for general host-level file access or shell execution.
No enforceable command allowlist, permitted path list, sandbox policy, privilege boundary, user-confirmation requirement, or argument validation mechanism is provided. Although the security guidance mentions allowlisting commands and using a sandbox, these are recommendations rather than implemented controls. The troubleshooting documentation also recommends elevated execution when permissions are insufficient, increasing the risk that users or integrating agents may bypass operating-system access controls.
The repository contains only
SKILL.md; therefore, no implementation exists through which the claimed restrictions can be verified. Exploitability depends on whether the hosting Agent grants the declared tools and follows the Skill's generic execution instructions.Attack Path
- The Skill is installed on an Agent platform that grants the declared
read,write, andexeccapabilities. - An attacker supplies crafted content through a booking request, painter description, API response, or other untrusted input processed by the Agent.
- The input induces the Agent to treat embedded instructions as operational steps, such as reading a sensitive local file, modifying a configuration file, or executing a shell command.
- Because the Skill defines no enforceable command or path restrictions, the Agent may invoke the broadly au ...[truncated 1123 chars]
- The Skill is installed on an Agent platform that grants the declared
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the declared tools unless each capability is demonstrably necessary for the booking workflow. - Replace general command execution with a narrowly scoped API client that can communicate only with explicitly approved HTTPS endpoints.
- Define the exact API hostname, endpoint paths, HTTP methods, request schema, authentication mechanism, timeout policy, and response-size limits.
- If file access is required, restrict it to a dedicated application directory and enforce canonical-path validation to prevent traversal and symbolic-link attacks.
- If command execution cannot be removed, use fixed executable paths and static argument templates. Reject shell metacharacters and never interpolate user-controlled input into command strings.
- Enforce command and path restrictions in code or platform policy rather than relying on documentation.
- Run the Skill under a dedicated, unprivileged operating-system account in an isolated sandbox with minimal network and file-system access.
- Require explicit user confirmation before any action that changes files, invokes a command, transmits sensitive data, or creates a paid booking.
- Remove guidance recommending administrator or elevated execution. Diagnose and correct the required permission model instead.
- Treat user input and external API responses as untrusted data, and ensure they cannot introduce new Agent instructions or tool calls.
- Remove