T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:16- Finding
Excessive Local File and Command-Execution Capabilities
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16-20
Additional Evidence:SKILL.md:184-188
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - glob - grepThe later feature description also explicitly advertises general file-processing and system-command execution capabilities, despite the skill's stated purpose being Brave Search API access.
Technical Analysis
The skill requests arbitrary command execution, local file reading, filesystem enumeration, and content-search capabilities. These permissions are broader than those normally required to submit HTTPS requests to the Brave Search API and parse its responses.
Although the documentation recommends sandboxing and command allowlisting, it does not define a command allowlist, permitted filesystem paths, argument validation rules, or technical enforcement controls. The project contains only
SKILL.md, so no implementation is available that demonstrates effective sandboxing or restriction of these capabilities.This violates the principle of least privilege. If an agent exposes the declared tools while processing untrusted user instructions or retrieved web content, those inputs could influence the agent to inspect local files or execute commands unrelated to web search.
Attack Path
- A user invokes the skill to perform a web search.
- The agent loads the skill with access to
read,glob,grep, andexec. - The user supplies a malicious instruction, or retrieved web content contains instructions designed to influence the agent.
- The agent is induced to enumerate files with
glob, locate sensitive content withgrep, read local data withread, or invoke a system command withexec. - Sensitive local information may be included in tool output or subsequent responses, or an unintended command may alter data withi ...[truncated 962 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read,glob, andgrepunless each tool is demonstrably required for the search workflow. - Replace general-purpose tools with a dedicated Brave Search API client restricted to the official HTTPS endpoint and necessary HTTP methods.
- Use an explicitly named credential such as
BRAVE_SEARCH_API_KEY, inject it only into the API client, and prevent it from appearing in prompts, logs, errors, or responses. - If local file access is necessary, restrict it to a dedicated working directory and reject absolute paths, traversal sequences, symbolic-link escapes, and access to credential files.
- If command execution is unavoidable, enforce a concrete executable and argument allowlist without shell interpolation. Run commands in a sandbox with minimal filesystem, network, and operating-system privileges.
- Treat user input and retrieved web content as untrusted data. Do not interpret search results as agent instructions or allow them to authorize tool calls.
- Document the exact Brave API endpoint, authentication header, accepted request fields, response-size limits, timeout behavior, redirect policy, and output-redaction rules.
- Add tests confirming that the skill cannot read files outside its workspace, execute unapproved commands, disclose credentials, or follow tool-use instructions embedded in search results.
- Remove