T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:5- Finding
Excessive and Inconsistent Tool Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5 and 14-17
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Configuration
yaml allowed-tools: read execyaml tools: - exec - read - writeTechnical Analysis
The Skill is intended to generate CSS layouts, animations, responsive styles, and component styling. These text-generation functions do not inherently require arbitrary command execution or unrestricted filesystem access.
Nevertheless, the manifest requests
exec,read, andwrite. The declarations are also inconsistent:writeappears undertoolsbut not underallowed-tools. Depending on how the hosting Agent interprets these fields, the Skill may receive broader capabilities than its advertised purpose requires, or permission enforcement may vary between platforms.The presence of
execis particularly sensitive because it can permit system-command execution in the Agent's security context. Broadreadandwritecapabilities may expose project files or permit unauthorized modification if attacker-controlled prompts, untrusted project content, or prompt injection influence tool calls.No direct instruction in the audited file was found that intentionally executes malicious commands, accesses sensitive files, or exfiltrates data. The vulnerability is the unnecessary exposure of privileged tools and the resulting attack surface.
Attack Path
- A hosting Agent loads the Skill and grants the tools declared in its manifest.
- The Agent processes attacker-controlled input or untrusted content containing instructions to invoke a privileged tool.
- Because
exec,read, orwriteis available despite not being necessary for CSS generation, the induced action may pass the Skill's capability boundary. - The Agent may execute a system command, read an accessible local file, or modify ...[truncated 880 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the manifest if the Skill only returns generated CSS and HTML as conversational output. - If file output is an essential feature, grant only narrowly scoped write access to explicitly selected project files or a dedicated output directory.
- Avoid granting
execunless a documented workflow requires a specific command. If execution is unavoidable, enforce a fixed command allowlist, prohibit shell interpolation, and pass validated arguments without invoking a shell. - Make
allowed-toolsandtoolsconsistent, preferably using one authoritative permission declaration supported by the target platform. - Require explicit user approval before reading or overwriting files, and reject paths outside the designated workspace.
- Apply sandboxing, minimal operating-system privileges, filesystem isolation, execution timeouts, and output-size limits at the Agent platform level.
- Remove generic claims of API integration, broad file processing, and system-command execution unless those capabilities are implemented and required by the CSS workflow.
- Remove