T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:21- Finding
Overprivileged Command Execution and File-Write Capabilities
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 21-24
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code Snippet
yaml tools: - read - exec - writeThe skill also describes system-command execution at
SKILL.md:243and recommends running with administrator privileges as a response to permission errors atSKILL.md:278.Technical Analysis
The skill is presented as a Java development standards and code-review reference, for which read-only access is sufficient in its documented primary workflow. Nevertheless, it requests both arbitrary command execution and file-write capabilities.
Granting
execpermits commands to run with the privileges of the hosting agent process. Grantingwritepermits modification of files accessible to that process. These permissions substantially exceed those required to read development guidelines and evaluate submitted Java code.The risk is amplified by the troubleshooting guidance that recommends administrator execution when permissions are insufficient. The skill does not identify a narrowly scoped operation that requires elevation, define an allowlist of commands or writable paths, or require explicit user confirmation before privileged actions.
No concrete malicious command, automatic privilege-escalation mechanism, or embedded executable payload was found. Exploitation therefore depends on the agent acting on malicious or untrusted task content while the excessive permissions are enabled.
Attack Path
- A user or agent loads the skill and grants its declared
read,exec, andwritecapabilities. - Untrusted Java source, review instructions, or other task content introduces instructions that induce the agent to execute a command or alter a file.
- Because the skill has declared command-execution and write access, the agent may perform the induced action instead of remai ...[truncated 919 chars]
- A user or agent loads the skill and grants its declared
- Remediation
View remediation
Remediation Suggestions
- Remove
execandwritefrom the declared tools and retain only read-only access for documentation lookup and code review. - If file output is genuinely required, request write access only when the user explicitly asks to save a report, and restrict writes to a user-approved output path.
- If command execution is required for an optional validation workflow, expose it as a separate opt-in capability with:
- An explicit command allowlist.
- Fixed executable paths.
- Structured arguments rather than shell command strings.
- Shell metacharacter rejection.
- Timeouts and resource limits.
- A restricted working directory.
- Explicit user confirmation before execution.
- Remove the generic recommendation to run as administrator. Document the minimum specific permission needed for each operation and require explicit informed approval for any elevation.
- Run the skill in a sandbox with no access to sensitive environment variables, credentials, system directories, or unrelated repositories.
- Add a clear trust-boundary rule stating that reviewed source code and user-supplied content are data and must never be interpreted as operational instructions.
- Remove