T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:16- Finding
Excessive System Tool Permissions for a Prompt-Based Asset Generation Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16-19andSKILL.md:251-254
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumThe Skill declares local file-reading, file-writing, and command-execution capabilities even though its documented purpose is AI-assisted game asset and game-concept generation.
yaml tools: - read - exec - writeThe document also advertises command execution:
markdown - **Command execution**: Execute system commands in a secure sandbox and collect resultsTechnical Analysis
The declared
execcapability grants the Agent access to a system command-execution channel, whilereadandwritemay permit access to local files. The documented workflow does not define any concrete local command, executable implementation, or asset-processing operation that requires unrestricted command execution or filesystem access.This violates the principle of least privilege. The claim that commands execute in a secure sandbox is descriptive only: the Skill does not specify or enforce sandbox boundaries, an allowed-command list, path restrictions, argument validation, environment-variable filtering, or user confirmation.
If the hosting Agent treats the tool declaration as authorization, adversarial content supplied through an asset-generation request could attempt to induce tool calls unrelated to the Skill's legitimate purpose. Exploitation ultimately depends on the host Agent's permission model and enforcement controls.
Attack Path
- A user or external workflow loads the Skill in an Agent that honors its declared tools.
- The attacker provides an adversarial game-asset prompt containing instructions designed to trigger local file access or command execution.
- The Agent interprets the embedded instructions as part of the Skill workflow and invokes
read,write, orexec. - Without e ...[truncated 1100 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execbecause the documented prompt-based asset-generation workflow does not demonstrate a legitimate need for operating-system command execution. - Remove unrestricted
readaccess unless the Skill must consume local source assets. If reading is required, restrict it to explicitly selected files under a dedicated project directory. - Retain
writeonly if generated assets must be saved locally, and restrict output to a dedicated directory using canonical-path validation. - If command execution is operationally necessary, enforce all of the following outside the Markdown instructions:
- A fixed allowlist of executable names and operations.
- Fixed or strictly validated arguments without shell interpolation.
- Execution without a shell where possible.
- A sandbox with minimal filesystem and network access.
- A low-privilege operating-system account.
- Environment-variable filtering to prevent credential exposure.
- Resource limits and execution timeouts.
- Explicit user confirmation before every command.
- Audit logging of commands, arguments, accessed paths, and results.
- Treat all user-provided prompts and asset metadata as untrusted data and prohibit them from controlling command names, command arguments, or filesystem paths.
- Replace the general statement about secure sandbox execution with precise, enforceable permission boundaries and document the exact operations the Skill requires.
- Remove