T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:33- Finding
Overprivileged Tool Declaration for Search-Only Functionality
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33–37
Vulnerability Type: Excessive agent tool permissions
Risk Level: MediumThe Skill declares the following tools:
yaml tools: - read - exec - glob - grepTechnical Analysis
The declared functionality is limited primarily to encoding keywords, generating search-engine URLs, opening those URLs, and comparing search results. These operations do not require unrestricted command execution or broad access to the local filesystem.
The
exec,read,glob, andgreptools provide substantially broader capabilities:execcan run local commands with the privileges of the hosting Agent process.readcan expose files unrelated to the search task.globcan discover files across accessible directories.grepcan search accessible files for credentials, configuration values, or other sensitive information.
The document contains examples that create a configuration file and perform a connectivity check, but these optional operations do not justify granting all listed tools for ordinary search requests. A constrained browser or HTTP capability is sufficient for the Skill's core purpose.
No instruction in the audited file directly orders the Agent to steal files or execute a malicious command. The risk arises because the excessive tools enlarge the consequences of malicious user input, prompt injection in retrieved search content, or incorrect Agent behavior.
Attack Path
- A user initiates a search through the Skill.
- The Agent opens a search result or processes attacker-controlled content returned by a search engine.
- The content contains prompt-injection instructions that attempt to redirect the Agent from the search task.
- Because the Skill declares
glob,grep, andread, the influenced Agent may discover and inspect unrelated local files. - Because
execis also available, the influenced ...[truncated 1215 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read,glob, andgrepfrom the default tool declaration. - Grant only a constrained browser or HTTP tool that permits navigation to an explicit allowlist of documented search-engine domains.
- Perform URL encoding through a built-in, non-shell utility rather than invoking command-line programs.
- If local configuration is necessary, expose a narrowly scoped configuration API restricted to a dedicated application directory instead of general filesystem tools.
- Require explicit user confirmation before creating or modifying files or running any connectivity diagnostic.
- Treat search results and retrieved pages as untrusted data. Prevent their contents from authorizing tool calls or changing system and Skill instructions.
- Apply URL validation, domain allowlisting, redirect controls, request timeouts, and response-size limits to outbound search requests.
- Run any unavoidable command execution in a sandbox with restricted filesystem access, no inherited secrets, limited network access, and a non-privileged operating-system identity.
- Remove