T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:5- Finding
Unnecessary Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 5 and 20-23
Vulnerability Type: Excessive tool permissions and inconsistent capability declarations
Risk Level: MediumVulnerable Configuration
yaml allowed-tools: read execyaml tools: - exec - read - writeTechnical Analysis
The skill generates live-stream scripts through natural-language instructions and templates. It is explicitly described elsewhere in the document as a pure Markdown skill, so its primary function does not require arbitrary command execution or access to local files.
Nevertheless, the manifest requests
exec,read, andwrite. These capabilities exceed the least privileges required for text generation:execmay permit arbitrary local command execution.readmay expose files available to the hosting agent.writemay allow modification or creation of local files.- The declarations are inconsistent:
writeis listed undertoolsbut omitted fromallowed-tools. Platform-specific interpretation could result in ambiguous or unexpectedly broad permissions.
The document recommends using only allowlisted commands and avoiding command construction from user input, but this narrative recommendation does not technically restrict the declared
execcapability.Attack Path
- A platform loads the skill and grants one or more of the declared
exec,read, orwritecapabilities. - The skill processes attacker-controlled or otherwise untrusted live-stream content.
- Malicious instructions embedded in that content attempt to induce the agent to invoke an unnecessary tool.
- If the agent follows those instructions without adequate tool-level authorization, it could read accessible local files, modify files, or execute commands under the agent process identity.
- The resulting access would be limited by the operating-system privileges and sandbox controls applied to t ...[truncated 996 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read, andwritefrom the skill manifest because ordinary script generation requires no external tools. - Keep
allowed-toolsandtoolsconsistent, or use only the canonical permission field supported by the target platform. - If output persistence is an essential feature, replace general filesystem access with a narrowly scoped save operation restricted to a dedicated output directory.
- If command execution becomes strictly necessary, expose only a fixed wrapper with an explicit command allowlist. Do not provide a general shell, and do not interpolate user-controlled values into command strings.
- Require explicit user approval for any sensitive operation and enforce restrictions at the tool or sandbox layer rather than relying on instructions in Markdown.
- Run the skill with minimal operating-system privileges and deny access to secrets, unrelated project files, network resources, and sensitive directories.
- Add automated manifest validation that rejects unnecessary capabilities and detects discrepancies between separate permission declarations.
- Remove