T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:24- Finding
Excessive Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:24andSKILL.md:222-223
Vulnerability Type: Excessive tool permissions that violate least-privilege principles
Risk Level: MediumVulnerable Configuration
yaml tools: ["read", "write", "exec"]The skill later confirms that command execution may be used:
markdown - **Availability classification**: MD+EXEC (pure Markdown instructions; some functions require exec command-line execution capability) - **Description**: Markdown-based AI Skill driven by natural-language instructions to produce spreadsheet solutions; users can copy and paste the output into office softwareTechnical Analysis
The skill principally operates as a Markdown-based spreadsheet advisor. Its documented functions are generating formulas, pivot-table configurations, data-cleaning procedures, and limited automation guidance. These advisory functions do not establish a clear requirement for unrestricted filesystem writes or arbitrary command execution.
Nevertheless, the metadata grants
writeandexeccapabilities in addition toread. No command allowlist, path restriction, argument validation policy, execution sandbox, or user-confirmation boundary is defined. The generic parameter descriptions also state that the skill supports create, export, save, conversion, and import operations without specifying how execution inputs are constrained.This configuration breaks the principle of least privilege. If untrusted spreadsheet content, a crafted user request, or model-generated instructions are interpreted as operational commands, the agent could invoke capabilities that are substantially broader than those needed to provide spreadsheet advice.
The reviewed project contains no executable scripts or direct malicious command payloads. Therefore, the issue is excessive capability exposure rather than evidence that the skill intentionally performs malicious execution.
...[truncated 1639 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
writeandexecfrom the declared tools. Retain onlyreadif inspection of user-provided spreadsheet files is genuinely required:yaml tools: ["read"] -
Prefer producing formulas, configuration instructions, and cleaning procedures as text rather than executing commands or modifying files.
-
If file generation is an essential feature, expose a narrowly scoped export operation instead of unrestricted filesystem writing. Restrict it to:
- A dedicated output directory
- Explicitly supported spreadsheet file extensions
- Newly created files rather than arbitrary overwrites
- Canonicalized paths that cannot escape the output directory
-
If command execution is indispensable, define:
- An explicit allowlist of executables and subcommands
- Fixed argument schemas with strict validation
- Prohibition of shell interpretation and command concatenation
- Rejection of metacharacters and attacker-controlled executable paths
- Resource, timeout, network, and working-directory restrictions
- Mandatory user confirmation showing the exact command before execution
-
Treat spreadsheet cells, filenames, formulas, imported data, and user-provided parameters as untrusted input. They must never be copied directly into shell commands.
-
Update the documentation to identify the exact operations requiring elevated capabilities and ensure each operation requests permission only when it is invoked.
-