T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:33- Finding
Overbroad File-Read and Command-Execution Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
cctv-news-fetcher
Security checks for vulnerabilities and agentic risk
Overview
The skill is a CCTV news fetcher, but it requests broad read and command-execution capability without enforceable limits or a clear reason tied to news retrieval.
Install only in a tightly sandboxed agent environment if you need this skill. Treat it as Review-worthy until the publisher removes generic exec access, constrains file/API behavior, documents exact CCTV endpoints and inputs, and implements any command allowlist it claims to use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Generic command-execution capability is unnecessary for a skill whose stated purpose is fetching and parsing CCTV news highlights. In an agent environment, declaring exec without strict limits can allow arbitrary shell actions if the model or wrapper interprets user content unsafely, turning a simple data-fetching skill into a system-impacting primitive.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation guidance is broad and lacks clear activation boundaries, which can cause the agent to apply the skill in contexts beyond intended CCTV news fetching. When combined with declared exec and broader data-handling language, vague triggering increases the chance of accidental or prompt-induced misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The FAQ explicitly says the fetcher only supports Chinese news content. This is a natural-language locale restriction, and the document does not present it as an optional user-selected mode or justify it as a region-specific compliance limitation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The security section asserts that only whitelisted commands are executed, but the manifest exposes only a generic exec capability and provides no enforceable whitelist. This mismatch can create false confidence for users and reviewers while leaving the actual runtime free to execute unintended commands if prompted or implemented unsafely.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is presented as a narrowly scoped CCTV news fetcher, but the documentation expands its scope to generic file handling, API integration, command execution, and information retrieval. This scope creep increases the chance an agent will authorize broader actions than users expect, enabling misuse of filesystem, network, or shell capabilities under a misleadingly narrow skill name.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill mentions file writing, external API use, and command execution without a prominent user-facing warning about system and data impact. Users may invoke what appears to be a simple news-fetching tool without understanding that it could access the network, modify files, or run commands, undermining informed consent and safe delegation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation claims file write capability despite the skill being described only as fetching and parsing news highlights. Unnecessary write access creates avoidable risk of overwriting local files, dropping artifacts in sensitive locations, or persisting untrusted content when users would expect a read-only retrieval workflow.
- Content
Static analysis
No suspicious patterns detected.