T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:16- Finding
Excessive Tool Permissions and Unsafe Privilege-Escalation Guidance
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16–18; related administrator-execution guidance at lines 145 and 193
Vulnerability Type: Excessive execution capability and privilege escalation
Risk Level: Mediumyaml tools: - read - execTechnical Analysis
The skill declares both unrestricted file-reading and command-execution capabilities even though its stated purpose is producing internal communications. Command execution is not demonstrated as necessary for that purpose, resulting in a violation of the principle of least privilege.
The risk is compounded by troubleshooting guidance at lines 145 and 193 that recommends running with administrator privileges when permissions are insufficient. If an agent or operator follows this advice, commands subsequently invoked through the declared
execcapability could run with elevated operating-system privileges.No executable script or explicit malicious command is included in the audited project. Consequently, exploitation is conditional on the hosting agent exposing the declared tools and choosing to execute commands based on untrusted task content. Nevertheless, the permission declaration creates an unnecessary command-execution channel, while the administrator guidance can increase the privileges available through that channel.
Attack Path
- The skill is loaded by an agent that grants the
readandexectools declared inSKILL.md. - An attacker supplies crafted internal-communications content or task parameters that encourage the agent to inspect local files or invoke a shell command.
- The skill's broad tool declaration permits the agent to use file-reading or command-execution functionality outside the legitimate writing task.
- If a permission error occurs, the troubleshooting guidance may persuade an operator or automated environment to rerun the operation with administrator privileges.
- A resulting command may then ...[truncated 746 chars]
- The skill is loaded by an agent that grants the
- Remediation
View remediation
Remediation Suggestions
- Remove the
exectool because command execution is not required for generating internal communications. - Restrict file access to explicitly supplied documents or a dedicated workspace rather than granting general-purpose
readaccess. - Remove the recommendations at lines 145 and 193 to run as administrator. Replace them with instructions to correct ownership, narrowly scoped access-control entries, or workspace permissions.
- If command execution is genuinely required, document the exact use case and enforce a fixed allowlist of commands and arguments. Do not construct commands from user-controlled content.
- Run the skill in a sandbox under a dedicated, unprivileged account with read-only access by default, no access to secrets, and no ability to elevate privileges.
- Require explicit human approval before every command invocation and display the complete executable, arguments, working directory, and effective user.
- Validate and canonicalize all paths, constrain them to an approved workspace, and reject traversal, symbolic-link escapes, shell metacharacters, and unexpected file types.
- Add tests confirming that communication content cannot trigger shell execution, read files outside the approved workspace, or cause the agent to request elevated privileges.
- Remove the