T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:26- Finding
Excessive Read and Command-Execution Permissions for a Markdown-Only Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 26–28
Supporting Evidence:SKILL.md, lines 449 and 454
Vulnerability Type: Excessive tool permissions and insufficient least-privilege controls
Risk Level: MediumVulnerable Code
yaml tools: - read - execTechnical Analysis
The Skill declares both unrestricted file-reading and command-execution capabilities. However, its own documentation identifies it as a pure Markdown instruction Skill whose core functionality does not require command-line execution. It also states that optional cloud CLI credentials may be configured for resource queries and deployments.
Granting
readandexecby default breaks the principle of least privilege. An Agent executing this Skill could access local files and run commands with the permissions of the hosting process, even though generating cloud architecture recommendations does not inherently require either capability.The document does not define command allowlists, protected file boundaries, read-only cloud roles, approval gates, dry-run requirements, or restrictions on destructive cloud operations. No directly malicious command or deliberate credential-exfiltration instruction was found, but the unnecessary capabilities create an exploitable privilege boundary if untrusted or manipulated task content influences tool use.
Attack Path
- The Skill is loaded with
readandexecenabled. - A user optionally configures authenticated AWS, Azure, GCP, or other cloud CLI credentials as described by the Skill.
- Untrusted, misleading, or manipulated task content causes the Agent to formulate local shell or cloud CLI commands.
- The Agent executes those commands using the host user's local permissions and configured cloud identity.
- Depending on the identity's privileges, the commands could inspect local sensitive files, query cloud resources, or modify cloud in ...[truncated 960 chars]
- The Skill is loaded with
- Remediation
View remediation
Remediation Suggestions
- Remove
readandexecfrom the default tool declaration because the documented core functionality only generates advisory content. - Separate architecture generation from operational deployment. Deployment capabilities should require an explicit, independently enabled mode.
- Require clear user confirmation immediately before every command that can modify cloud or local resources.
- Restrict execution to an allowlist of reviewed commands and arguments; reject shell metacharacters, command chaining, substitutions, and arbitrary scripts.
- Use read-only cloud roles for discovery and cost analysis. Grant narrowly scoped deployment roles only for the specific account, project, region, and resource types required.
- Default cloud operations to validation, planning, or dry-run modes. Present the generated plan to the user before applying changes.
- Prevent access to credential stores, SSH keys, environment-secret files, and unrelated filesystem paths.
- Execute approved operational commands in an isolated environment with network, filesystem, time, and resource limits.
- Record commands and resulting resource changes in an audit log while redacting secrets and sensitive output.
- Document rollback procedures and prohibit destructive commands unless the user provides separate, explicit authorization.
- Remove