T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:23- Finding
Unnecessary Command-Execution Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:23-29
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Mediumyaml tools: - read - exec - write - glob - grep homepage: ''The declared capability conflicts with the Skill's own statements at
SKILL.md:210-211:text **API Key configuration:** This Skill does not require an API key. It is driven entirely by Markdown instructions, stores all memory locally under `$HOME/decision-architect/`, and makes no network requests. **Availability classification:** MD (pure Markdown instructions with no need for exec command-line capability).Technical Analysis
The Skill requests the
exectool even though it explicitly states that command-line execution is unnecessary. Its documented functionality consists of decision analysis and local Markdown-based state management, for which narrowly scoped file-reading and file-writing capabilities are sufficient.Providing shell execution violates the principle of least privilege. Although the audited instructions do not explicitly invoke commands or contain a malicious payload, the unnecessary capability expands the consequences of prompt injection, malformed user input, or future instruction changes. An Agent that interprets attacker-controlled decision text as operational instructions could use
execto run commands outside the legitimate decision-analysis workflow.Attack Path
- The Skill is loaded with the declared
execpermission. - An attacker supplies decision-related content containing adversarial instructions that attempt to induce command execution.
- The Agent incorrectly treats those instructions as part of the Skill workflow.
- Because shell execution is already authorized, the Agent invokes
exec. - The command runs with the operating-system privileges and environmental access of the Agent process.
This is an enabling atta ...[truncated 608 chars]
- The Skill is loaded with the declared
- Remediation
View remediation
Remediation Suggestions
- Remove
execfrom the declaredtoolslist because the documented workflow does not require shell commands. - Retain only capabilities necessary for the workflow, such as
readandwrite. - Restrict write access to the documented
$HOME/decision-architect/directory rather than granting unrestricted filesystem writes. - Remove
globandgrepunless a concrete workflow requires them; otherwise, constrain their search scope to the Skill's designated data directory. - Enforce runtime authorization for sensitive tool calls so user-supplied content cannot independently trigger shell or unrestricted filesystem operations.
- Treat all decision text and persisted records as untrusted data, not executable Agent instructions.
- Remove the optional
callback_urlparameter atSKILL.md:99if networking is unsupported, or document and implement strict HTTPS-only URL validation, destination allowlisting, private-address blocking, redirect controls, and explicit user approval before callbacks.
- Remove