T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:13- Finding
Excessive Local File and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13–16; supporting declarations at lines 181–185
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: MediumVulnerable Configuration
yaml tools: - read - exec - writeThe skill further advertises these capabilities:
markdown ## 主要功能 - **自动化执行**: 管理Jira个人访问令牌(PAT),支持创建、撤销和权限配置。API封装工具。适用于需要调用外部API的场景，API请求 - **文件处理**: 支持多种文件格式的读取、解析和写入操作 - **API集成**: 通过标准化接口调用外部服务并处理响应 - **命令执行**: 在安全沙箱中执行系统命令并收集结果Technical Analysis
The declared purpose of the skill is to create, revoke, and configure Jira personal access tokens through an external API. That purpose does not inherently require arbitrary local file reads, local file writes, or operating-system command execution.
The skill nevertheless requests the general-purpose
read,write, andexectools. No concrete command allowlist, filesystem path restriction, argument validation mechanism, API-origin restriction, or enforceable sandbox policy is defined. The document states that commands should be allowlisted and run in a sandbox, but it does not implement those controls.The required
instructioninput is free-form user text. If the host exposes the requested tools and the Agent interprets malicious or ambiguous input as authorization to use them, those broad capabilities could be applied to resources unrelated to Jira PAT management.Attack Path
- The skill is installed or activated for a Jira PAT management request.
- The host grants the skill its declared
read,write, andexeccapabilities. - An attacker or untrusted user supplies a crafted free-form
instructionvalue, or malicious content enters the Agent context through another source. - The Agent interprets that content as requiring local file access or command execution.
- Because no enforceable command allowlist or filesystem boundary is specified, th ...[truncated 1202 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the declared tools unless each capability is strictly necessary and justified. - Replace the general-purpose tools with a dedicated Jira API client that exposes only explicit operations such as listing, creating, and revoking PATs.
- Restrict outbound requests to configured Jira HTTPS origins and reject redirects or requests to arbitrary hosts.
- Define a structured operation schema instead of accepting unrestricted instruction text. Validate operation names, token identifiers, tenant identifiers, and permission scopes against strict allowlists.
- Require explicit user confirmation immediately before PAT creation, revocation, or permission changes.
- Apply least-privilege Jira credentials and prevent the skill from requesting permissions broader than the selected operation requires.
- Redact PAT values, API keys, authorization headers, and other secrets from responses, errors, and audit logs.
- If local command execution is unavoidable, enforce a host-level sandbox, a fixed executable allowlist, non-shell argument invocation, strict time and resource limits, and a dedicated low-privilege process identity.
- If filesystem access is unavoidable, confine it to a dedicated workspace using canonical-path checks and deny access to credential stores, home directories, system paths, and files outside that workspace.
- Add automated tests verifying that unrelated file operations, arbitrary commands, unapproved Jira origins, and excessive permission scopes are rejected.
- Remove