T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:19- Finding
Overbroad Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-22
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The skill requests filesystem read access, filesystem write access, and command-execution capability. Its stated purpose is integration with the Figma API, but the package contains no implementation or concrete workflow demonstrating a legitimate requirement for unrestricted local file modification or shell execution.
Granting
execandwritesubstantially increases the skill's authority beyond what is inherently necessary for querying a remote design API. The document mentions command allowlisting and sandboxing as recommended safeguards, but it does not define an enforceable command allowlist, permitted argument patterns, filesystem boundaries, or input-validation controls.This is a least-privilege weakness rather than evidence of an embedded malicious payload. The reviewed file contains no command that directly exploits these permissions. Exploitation would depend on the hosting agent treating the declared tools as authorization and allowing user-controlled task content to influence tool calls.
Attack Path
- An agent loads the skill and grants the declared
read,write, andexectools. - An attacker or untrusted user submits a crafted request presented as a Figma automation or file-processing task.
- Because no enforceable command or path restrictions are defined, the request may steer the agent into invoking shell commands or accessing unrelated local files.
- The agent could read data outside the intended Figma workflow, overwrite accessible files, or execute commands with the operating-system privileges of the agent process.
- Any resulting compromise remains bounded by the sandbox, filesystem permissions, and process privileges enforced ...[truncated 714 chars]
- An agent loads the skill and grants the declared
- Remediation
View remediation
Remediation Suggestions
- Remove
execandwritefrom the tool declaration unless specific, documented Figma operations require them. - Prefer a narrowly scoped Figma API tool instead of general-purpose shell and filesystem tools.
- If local writes are required for image export, restrict them to a dedicated output directory and reject absolute paths, traversal sequences, and symbolic-link escapes.
- If command execution is unavoidable, define an enforceable allowlist of exact executables and argument schemas. Do not invoke a shell or concatenate user-controlled values into command strings.
- Require explicit user confirmation before destructive writes, overwrites, or execution of commands with effects outside the designated workspace.
- Run the skill in a sandbox with minimal operating-system permissions, no unnecessary credentials, restricted network access, and a read-only project filesystem where feasible.
- Document the exact operations requiring each tool and validate every user-controlled file path, node identifier, URL, and command argument before use.
- Add automated tests confirming that requests cannot access files outside approved directories or execute commands outside the allowlist.
- Remove