T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:28- Finding
Overprivileged Command Execution and Administrator-Level Troubleshooting Guidance
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:28-31andSKILL.md:452-461
Vulnerability Type: Excessive tool permissions and unsafe privilege-escalation guidance
Risk Level: MediumVulnerable Configuration
yaml tools: - read - exec - glob - grepThe skill also states that it supports file processing and system-command execution, and its troubleshooting table recommends running with administrator privileges when file permissions are insufficient.
Technical Analysis
The skill primarily provides Game AI design guidance and code-generation examples, but it requests the general-purpose
exectool alongside broad file-reading and discovery capabilities. No concrete executable workflow, command allowlist, permitted-directory boundary, argument-validation policy, or task-specific justification for elevated access is defined.Although the document says commands are executed in a secure sandbox, this is only a documentation assertion; the package contains no implementation that enforces sandboxing. The generic recommendation at
SKILL.md:461to run as an administrator can cause an agent or user to bypass an intended filesystem permission boundary rather than diagnose and correct the underlying access requirement.Untrusted file paths, repository content, or command arguments could therefore reach a broadly capable execution interface. If administrator or root privileges are subsequently granted, the impact of unsafe command construction, generated commands, or malicious project input would be significantly increased.
Attack Path
- An attacker supplies a project, path, filename, or command-related parameter containing malicious or unexpected content.
- The skill invokes its declared filesystem or
execcapability while processing that input. - The operation encounters a permissions error when accessing a protected resource.
- Following the troubleshooting guidance, the user or ag ...[truncated 988 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
execcapability unless a documented Game AI workflow strictly requires local command execution. - If execution is necessary, replace unrestricted shell access with narrowly scoped operations and an explicit command allowlist.
- Pass arguments as structured process parameters rather than constructing shell command strings.
- Reject shell metacharacters and validate all user-controlled paths, filenames, options, and environment values.
- Restrict filesystem access to a user-selected project workspace using canonical-path checks and deny path traversal or symbolic-link escapes.
- Remove the generic recommendation to run as administrator or root. Instead, identify the minimum required file or directory permission and instruct users to correct only that permission.
- Require explicit user confirmation before writes, dependency installation, destructive operations, or any action outside the project workspace.
- Enforce sandboxing at the agent-runtime level with a nonprivileged account, restricted environment variables, resource limits, disabled network access where unnecessary, and an isolated temporary directory.
- Document the exact commands, allowed arguments, accessible directories, and expected side effects for every executable workflow.
- Add tests verifying that malicious arguments, traversal paths, protected paths, and permission failures cannot trigger unrestricted or elevated execution.
- Remove the