T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:6- Finding
Excessive Tool Permissions for a Markdown-Only GTM Planning Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 6 and 14-17
Vulnerability Type: Excessive read, write, and command-execution permissions
Risk Level: MediumRelevant Code:
yaml allowed-tools: read exec tools: - exec - read - writeTechnical Analysis
The skill describes itself as a Markdown-based tool that generates go-to-market strategy documents through natural-language interaction. Its documented core functionality does not require arbitrary command execution or broad filesystem access.
Nevertheless, the configuration requests
execandreadaccess throughallowed-tools, while the separatetoolssection additionally requestswrite. Granting these capabilities violates the principle of least privilege:readmay expose files outside the information required to prepare a marketing plan.writemay allow modification of local files despite no demonstrated need for filesystem persistence.execmay allow arbitrary processes or shell commands to run with the hosting agent's operating-system privileges.- The discrepancy between
allowed-toolsandtoolscreates ambiguous enforcement behavior. A platform that trusts the broadertoolsdeclaration may grant write access even though it is absent fromallowed-tools.
The file contains no explicit malicious command or direct instruction to exploit these permissions. The risk arises because unnecessary high-impact capabilities are exposed to any instructions or untrusted content processed in the skill's execution context.
Attack Path
- A user supplies attacker-controlled product details, imported content, or other untrusted text while the skill is active.
- That content attempts to induce the agent to invoke one of the declared tools.
- If the agent or hosting platform does not strictly isolate untrusted data from instructions, the agent may use
readto access unrelated local data,writeto al ...[truncated 1188 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the skill because the documented GTM-planning workflow can be performed without operating-system tools. - If tool use is genuinely required, declare only the minimum capability in one authoritative configuration field and eliminate the conflict between
allowed-toolsandtools. - Replace broad filesystem permissions with access limited to an explicit workspace directory and approved output filename.
- Replace arbitrary command execution with narrowly scoped, parameterized operations that do not invoke a shell.
- Require explicit user confirmation before reading files, overwriting data, or executing commands.
- Treat product descriptions and imported marketing content strictly as untrusted data, not executable instructions.
- Run the skill in a sandbox with restricted filesystem access, no unnecessary credentials, no elevated operating-system privileges, and network access disabled unless specifically required.
- Add automated validation that rejects contradictory or undeclared tool permissions during skill installation.
- Remove