T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:13- Finding
Excessive Tool Permissions Violate Least-Privilege Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13–16; supporting behavior at lines 56–57, 112, 286–288, and 301
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Highyaml tools: - read - exec - writeThe supporting instructions state that the Skill may perform CRUD operations that update system state, accept API request URLs and headers, read and write files, execute system commands, and recommend elevated execution when filesystem permissions are insufficient.
Technical Analysis
The Skill is presented as a Linear project-management API wrapper, but it requests unrestricted
read,write, andexeccapabilities. These permissions exceed those ordinarily required to communicate with the Linear API.The document claims that commands are executed in a sandbox and mentions command allowlisting as a security measure. However, it does not define enforceable command restrictions, permitted arguments, filesystem boundaries, network destination restrictions, or a concrete sandbox policy. It also accepts request URLs and headers without specifying an allowlist of trusted Linear API hosts.
Consequently, an Agent following this Skill could interpret attacker-controlled instructions as authorization to execute local commands, access or modify files, or send requests to unintended network services. The instruction recommending administrator execution following permission failures further increases the potential privilege boundary violation.
No executable implementation is included in the project, so exploitation depends on how the hosting Agent interprets and enforces the declared tools. The issue is nevertheless present in the Skill configuration because it explicitly requests capabilities beyond the documented task requirements.
Attack Path
- A user supplies a crafted project-management instruction containing a command, local file operation, or attacker ...[truncated 1296 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the declared tools unless each capability is indispensable to documented functionality. - Implement Linear integration through a dedicated, narrowly scoped HTTP tool instead of general command execution.
- Restrict network access to documented HTTPS Linear API hosts and explicitly approved routes.
- Validate HTTP methods, request schemas, payload sizes, headers, and identifiers before issuing requests.
- Never forward authentication headers or API keys to caller-selected URLs.
- If file access is required, restrict it to a dedicated workspace directory, reject path traversal, resolve symbolic links safely, and deny access to credential and system files.
- If command execution is unavoidable, use a fixed executable and argument-vector allowlist. Do not invoke a shell or interpolate user-controlled content into commands.
- Remove the recommendation to run with administrator privileges. Fail safely when permissions are insufficient and document the minimum required permissions.
- Convert the claimed sandbox and allowlist controls into enforceable configuration or implementation rather than relying on descriptive documentation.
- Require explicit user confirmation for destructive CRUD operations, file modifications, or other state-changing actions.
- Redact credentials, authorization headers, and sensitive response data from logs and returned output.
- Remove