T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:5- Finding
Overprivileged and Inconsistent Tool Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5 and 18–22
Vulnerability Type: Excessive tool permissions and inconsistent access-control configuration
Risk Level: MediumThe skill declares command execution and arbitrary file-reading capabilities despite its stated purpose being HTML/CSS design assistance. It also declares browser access in one tool list but omits it from the separate
allowed-toolsfield.yaml allowed-tools: read execyaml tools: - exec - read - browserThe document later describes additional broad capabilities:
markdown - **File processing**: Supports reading, parsing, and writing multiple file formats - **API integration**: Calls external services through standardized interfaces - **Command execution**: Executes system commands in a secure sandboxTechnical Analysis
Generating HTML, CSS, design recommendations, color palettes, and typography guidance does not inherently require general-purpose shell execution, arbitrary local-file reading, or browser/network access. Granting these tools therefore violates the principle of least privilege.
The duplicated permission declarations are inconsistent:
allowed-toolspermitsreadandexec, while the latertoolslist additionally includesbrowser. Depending on how an agent platform resolves these fields, browser access may be unexpectedly enabled or permission enforcement may differ between runtimes.The skill does not contain a malicious command, remote payload, or direct instruction to access sensitive files. Exploitation would therefore require attacker-controlled input, generated content, or another untrusted instruction to influence the tool-enabled agent. The exposed capabilities nevertheless increase the consequences of such manipulation.
Attack Path
- The agent loads the skill and grants the declared
read,exec, and potentiallybrowsercapabilities. - An ...[truncated 1424 chars]
- The agent loads the skill and grants the declared
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andbrowserfrom the skill unless a documented workflow strictly requires each capability. Pure HTML/CSS generation should normally require no tools. - Consolidate permissions into one authoritative declaration. Ensure
allowed-toolsandtoolscannot grant different capabilities. - If file access is necessary, restrict it to an explicitly approved project directory and deny access to credentials, home directories, environment files, SSH material, and system paths.
- If command execution is necessary, replace general shell access with narrowly scoped operations. Use fixed argument arrays, an explicit command allowlist, no shell interpolation, and mandatory user confirmation for consequential actions.
- If browser access is necessary for previewing generated pages, limit it to local preview URLs or an explicit origin allowlist. Block arbitrary external navigation and downloads by default.
- Remove or narrow unsupported generic claims about file writing, API integration, and command execution.
- Document the exact security boundary, sandbox restrictions, approved commands, accessible paths, and network destinations.
- Add tests that reject undeclared tools, permission-list inconsistencies, arbitrary command arguments, out-of-scope file paths, and unapproved network destinations.
- Remove