T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:35- Finding
Excessive Tool Permissions Violate Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35–38 and 254–256
Vulnerability Type: Excessive file-system and command-execution capabilities
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeThe declared capabilities are reinforced later in the document:
markdown - **文件处理**: 支持多种文件格式的读取、解析和写入操作 - **API集成**: 通过标准化接口调用外部服务并处理响应 - **命令执行**: 在安全沙箱中执行系统命令并收集结果The latter excerpt states that the skill supports file reading and writing, external API integration, and system-command execution.
Technical Analysis
The skill's stated purpose is to encode and decode Cashu tokens hidden in emoji through Unicode variation selectors. This operation can be implemented as a deterministic, local text transformation and does not inherently require arbitrary command execution, unrestricted file-system access, or external API access.
Nevertheless, the manifest requests
read,write, andexec. The documentation does not define command allowlists, permitted file paths, network destination restrictions, user-confirmation boundaries, or other enforceable controls. Although it claims commands run in a sandbox, the project contains onlySKILL.md; no implementation or policy is present to verify or enforce that claim.The audit did not find an embedded malicious command or a demonstrated implementation that actively abuses these permissions. The risk arises from unnecessarily broad declared privileges and the absence of concrete restrictions.
Attack Path
- A user invokes the skill and supplies a Cashu token or related data for Unicode encoding or decoding.
- The hosting agent grants the capabilities declared in the skill manifest: file reading, file writing, and command execution.
- A malicious, compromised, or prompt-manipulated execution path invokes those capabilities even though they are unnecessary for Unicode conversion.
- The execution path reads unrelated accessible files, modifies file ...[truncated 1150 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execbecause Unicode variation-selector encoding and decoding should not require operating-system commands. - Remove general
readandwritepermissions when input and output can be exchanged directly through the agent conversation. - If file processing is essential, restrict access to explicit user-selected files or a dedicated workspace directory.
- Require informed user confirmation before every write, overwrite, or operation involving sensitive token material.
- Remove external API integration unless a documented functional requirement exists. If retained, enforce an HTTPS destination allowlist and prohibit transmission of Cashu tokens, credentials, and unrelated file contents.
- Implement the encoder and decoder as a pure local transformation with strict input-size limits and validation of allowed Unicode variation selectors.
- Replace the general tool declarations with the smallest platform-specific capability set available.
- Add implementation code and security tests demonstrating that encoding and decoding cannot access files, launch processes, or make network requests.
- Clearly document the sandbox boundary and ensure restrictions are enforced by the host rather than relying on descriptive claims in Markdown.
- Remove