T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:32- Finding
Excessive Command Execution and File-Write Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 32–36
Vulnerability Type: Violation of least privilege
Risk Level: MediumVulnerable Configuration
yaml tools: - read - exec - write - glob - grepTechnical Analysis
The skill declares
execandwriteaccess even though its stated purpose is to explain code from a single file. Reading and explaining source code requires file-read capability, but it does not inherently require arbitrary command execution or file modification.The document later states that some functionality uses
execto read files, despite the dedicatedreadtool already being available. No feature described in the skill requires writing files. These permissions therefore exceed the minimum privileges necessary for the declared functionality.This creates a dangerous capability boundary: if untrusted source code, a user request, or another contextual instruction influences the agent's behavior, the unnecessarily available tools could be invoked to execute commands or alter files. The audited skill does not itself contain an instruction that actively abuses these tools, so exploitation depends on the hosting agent granting the declared permissions and being induced to misuse them.
The pre-scan warning concerning transmission of sensitive information was also reviewed. The optional
callback_urlfield is documented in an input-format table, but no instruction or implementation uses it to transmit data. No confirmed network exfiltration behavior was found.Attack Path
- The skill is loaded by an agent platform that grants all tools declared in its front matter.
- The agent receives attacker-controlled source code or a crafted explanation request containing adversarial instructions.
- The adversarial content attempts to persuade or confuse the agent into invoking
execorwrite. - Because those tools are unnecessarily available, the ag ...[truncated 865 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execandwritefrom the declared tools:yaml tools: - read - Retain
globorgreponly if file discovery or content searching is genuinely required; for strict single-file explanation, prefer read-only access to the explicitly selected file. - Replace every suggested use of
execfor reading files with the dedicatedreadtool. - Explicitly instruct the agent to treat analyzed source code and comments as untrusted data, not as executable agent instructions.
- If future functionality genuinely requires command execution, place it in a separate opt-in skill with command allowlisting, explicit user confirmation, workspace confinement, timeouts, output limits, and network isolation.
- Do not add callback transmission unless it is essential. If added later, require explicit consent, restrict destination schemes and hosts, block private and link-local addresses, and prevent source code, credentials, and environment data from being sent.
- Remove