T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:9- Finding
Excessive and Undefined Tool, Filesystem, Credential, and Network Privileges
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:9-11, 168-169, 199-202
Vulnerability Type: Excessive privileges and missing least-privilege boundaries
Risk Level: MediumVulnerable Configuration and Instructions
yaml tools: - read - execmarkdown 1. **Configure API key**: Set the corresponding API Key in environment variables 2. **Initialize connection**: Use the provided credentials to establish an API connectionmarkdown - LLM/API Key: The corresponding API key must be configured - Network connection: Access to external services is required - Filesystem: File read/write permissions are required - Runtime environment: Corresponding command-line tools are requiredTechnical Analysis
The skill advertises generic brand-guideline and data-processing functionality, yet declares arbitrary command execution through
execand broadly states that credentials, external network access, filesystem read/write access, and command-line tools are required.The document does not define:
- Which commands may be executed.
- Which files or directories may be accessed or modified.
- Which external hosts or API endpoints are permitted.
- Which credentials are needed or how narrowly they must be scoped.
- Which operations require user confirmation.
- How untrusted
contentoroptionsinput is separated from commands. - Why arbitrary execution is necessary for the advertised task.
This absence of enforceable boundaries violates least-privilege principles. The package contains only
SKILL.md, so there is no implementation demonstrating input validation, command allowlisting, path confinement, secret handling, or destination restrictions.Attack Path
- The skill is loaded with
readandexeccapabilities. - A user or untrusted data source supplies attacker-controlled
content,options, file paths, connection parameters, or processing instructions. - The underspecified “core processing” workflow causes the agen ...[truncated 1272 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
exectool unless command execution is essential to a clearly documented feature. - If execution is necessary, replace unrestricted execution with a fixed allowlist of commands and arguments; never interpolate untrusted input into shell command strings.
- Restrict filesystem access to explicit workspace directories and deny absolute paths, traversal sequences, symbolic-link escapes, and access to credential stores.
- Identify every required external API and enforce an outbound allowlist for exact schemes, hosts, ports, and endpoint paths.
- Use dedicated, short-lived, least-privileged credentials. Do not expose secrets in prompts, command arguments, output, files, or logs.
- Define strict schemas and size limits for
content,format, andoptions, and treat all submitted values as untrusted data rather than executable instructions. - Require explicit user confirmation before commands, file modifications, credential use, or transmission of data to external services.
- Document the precise capability required for each operation and deny all unspecified actions by default.
- Add implementation-level security tests covering command injection, path traversal, secret disclosure, unauthorized outbound requests, and workspace-boundary enforcement.
- Remove the