T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:22- Finding
Excessive Tool Permissions Violate Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22–27
Vulnerability Type: Excessive execution and file-write permissions
Risk Level: Mediumyaml tools: - read - exec - write - glob - grepTechnical Analysis
The skill declares access to the
execandwritetools even though its documented purpose is to analyze, segment, compare, and summarize documents. The same file describes the skill as pure Markdown whose core functionality requires only LLM capability and no command-line execution.Shell execution and arbitrary file modification are therefore unnecessary for the stated task and violate the principle of least privilege. Because analyzed documents are untrusted input, adversarial text could attempt to influence the agent into invoking these unnecessarily available tools. The actual exploitability depends on the host agent's tool authorization, sandboxing, path restrictions, and confirmation controls.
No executable implementation, malicious command, or instruction explicitly directing such misuse was found. This finding concerns the dangerous permission boundary created by the declared tool set.
Attack Path
- An attacker supplies a commercial, legal, or other document containing adversarial instructions disguised as document content.
- The skill loads and analyzes that untrusted content.
- The content attempts to induce the agent to treat embedded instructions as operational directions.
- The agent invokes the unnecessarily declared
execorwritetool. - If the hosting platform lacks effective confirmation, sandboxing, and path restrictions, commands may execute or files may be created or modified with the agent process's permissions.
Impact Assessment
Successful exploitation could permit command execution and filesystem modification within the privileges and accessible scope of the hosting agent. Potential consequences include alteration of project files, destruction or corruption of data, access t ...[truncated 397 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execandwritefrom the declared tool list because they are not required for the documented analysis workflow. - Retain only the minimum capabilities needed, preferably constrained read access to files explicitly selected by the user.
- If output files are genuinely required, replace general write access with a dedicated export operation restricted to a designated output directory and non-executable file types.
- Treat all document text as untrusted data and explicitly prohibit following commands or operational instructions embedded in analyzed content.
- Require interactive approval for any command execution or filesystem mutation if those capabilities are introduced later.
- Enforce workspace-scoped canonical paths, reject path traversal and symbolic-link escapes, and deny access to credentials, configuration directories, and system paths.
- Add regression tests using documents containing prompt-injection attempts to verify that document content cannot trigger tools or alter the skill's operating instructions.
- Remove