T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:22- Finding
Unnecessary Command Execution and Filesystem Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22–25
Vulnerability Type: Excessive tool permissions that violate least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeThe unnecessary capabilities are further advertised at
SKILL.md, lines 373–376:markdown - **File processing**: Supports reading, parsing, and writing multiple file formats - **API integration**: Calls external services through standardized interfaces and processes responses - **Command execution**: Executes system commands in a secure sandbox and collects results - **Information retrieval**: Rapidly searches and filters target dataTechnical Analysis
The Skill's stated purpose is to generate platform-specific photography captions from a photograph and contextual information supplied by the user. This task does not inherently require arbitrary system command execution or general filesystem write access.
Nevertheless, the manifest requests
execandwritein addition toread. The document does not define an enforceable command allowlist, restricted writable paths, argument validation, or sandbox policy. Its statement that commands run in a secure sandbox is descriptive prose rather than an implemented security control.This creates a least-privilege violation. In an Agent platform that automatically grants the declared tools, untrusted user input or adversarial text extracted from an image could influence the Agent into invoking capabilities unrelated to caption generation. Although no malicious command or confirmed exploitation payload is present in the audited file, the excessive permission boundary materially increases the consequences of prompt injection.
The configuration is also internally inconsistent: it advertises command execution while later describing the Skill as pure Markdown. This ambiguity can cause hosting platforms or reviewers to grant capabilitie ...[truncated 1695 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execandwritefrom the tool declaration because caption generation does not require command execution or filesystem modification. - Retain
readonly if the hosting platform needs it to access a user-selected image. Scope it to explicit user-provided files or an isolated upload directory. - Remove unsupported claims about generic command execution, file processing, API integration, and asynchronous callbacks unless those features are implemented and required.
- Make the availability classification consistent with the actual implementation by declaring the package a pure Markdown Skill.
- If execution is introduced in a future version, enforce controls in code rather than relying on prose:
- Permit only fixed executable paths and explicitly approved commands.
- Pass arguments as structured arrays instead of constructing shell command strings.
- Reject user-controlled command names, shell operators, paths, and environment-variable expansions.
- Disable network access unless a documented endpoint is essential.
- Restrict readable and writable paths to a dedicated workspace.
- Run with a non-privileged operating-system account in an isolated sandbox.
- Require explicit user confirmation before any external side effect.
- Treat image metadata, OCR output, captions, callback addresses, and all other user-provided values as untrusted data and prevent them from becoming tool instructions.
- Add automated manifest checks that reject capabilities not mapped to a documented and tested workflow requirement.
- Remove