T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:14- Finding
Excessive System Command Execution Capability
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 14-17; related declarations at lines 88-90 and 196-200
Vulnerability Type: Excessive privilege and unrestricted command-execution capability
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeRelated declarations describe the skill as supporting execution:
text ### Availability Classification - **Classification**: MD+execute() - **Description**: Markdown-based AI Skill,text ## Main Functions - **Automated execution**: Convert RSS/Atom feeds to Markdown using a bundled local converter - **File processing**: Supports reading, parsing, and writing multiple file formats - **API integration**: Calls external services through standardized interfaces and processes responses - **Command execution**: Executes system commands in a secure sandbox and collects results - **Information retrieval**: Searches and filters target dataTechnical Analysis
The skill requests
execaccess in addition to file-reading and file-writing permissions. Its stated purpose is to retrieve RSS or Atom feeds and convert them into Markdown, which does not inherently require unrestricted operating-system command execution.The project contains only
SKILL.md. It does not include the advertised converter, an executable allowlist, argument validation logic, a sandbox implementation, or another auditable component that constrains command execution. The skill also accepts a free-forminstructionstring. Consequently, an Agent that grants the declared capabilities may interpret user-controlled instructions as requests to execute arbitrary system commands.The documentation recommends using a command allowlist and sandbox, but these controls exist only as prose and are not technically enforced by any included implementation. The finding therefore concerns the unnecessary privilege request and absence of enforceable leas ...[truncated 1562 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
execcapability and implement feed retrieval and conversion using narrowly scoped read, network, and write operations. - Bundle the claimed converter implementation so its behavior can be reviewed rather than leaving command selection to Agent interpretation.
- If process execution is essential, invoke only a fixed executable using an argument array. Never construct shell command strings from the
instruction, feed URL, output path, or feed content. - Enforce an executable allowlist and reject shell metacharacters, unexpected options, and unsupported argument forms.
- Validate feed URLs before use. Restrict schemes to HTTPS where possible and apply network policies that prevent access to loopback, link-local, private, metadata-service, and other sensitive addresses.
- Restrict output paths to a dedicated workspace. Resolve and verify canonical paths to prevent traversal, symlink abuse, and writes outside the intended directory.
- Run conversion in a sandbox with minimal filesystem access, no inherited secrets, no unnecessary network access, a nonprivileged user, and strict CPU, memory, output-size, and timeout limits.
- Define a structured input schema with explicit feed URL and output options instead of accepting unrestricted instructions for execution-sensitive behavior.
- Require explicit user approval before any exceptional command execution and record the executable and sanitized arguments in an audit log.
- Add tests demonstrating that command-injection payloads, path traversal attempts, unsupported URL schemes, and unauthorized network destinations are rejected.
- Remove the