T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:29- Finding
Excessive Tool Permissions for a Documentation-Only Writing Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–32
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The Skill generates workplace communications such as status emails, escalation requests, and Slack or Teams messages. Its documented workflows operate on user-provided text and do not require local filesystem access or command execution.
Nevertheless, the manifest requests three powerful capabilities:
readcan expose files accessible to the hosting agent.writecan modify or create files within the agent's permitted scope.execcan run local commands under the agent process's operating-system privileges.
These permissions exceed the Skill's stated functional requirements. This unnecessarily increases the consequences of prompt injection, malicious user input, future instruction changes, or compromise of the Skill. The presence of these declarations does not prove that the current Skill executes malicious commands, but granting them breaks least-privilege boundaries and creates an avoidable privilege-escalation surface.
Attack Path
- An agent loads the Skill and grants the declared
read,write, andexectools. - The Skill processes attacker-controlled or otherwise untrusted communication content.
- Malicious injected instructions attempt to induce an agent tool call unrelated to workplace writing.
- Because the Skill has unnecessary tool access, the agent may read accessible local data, modify files, or execute commands if its tool-policy controls do not block the request.
- The resulting access occurs with the permissions of the hosting agent process and within any additional sandbox restrictions imposed by the platform.
No malicious invocation is present in the reviewed file; this path describes the risk enabled by the excessive permission declaration.
Impact
...[truncated 539 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
read,write, andexecbecause the documented text-generation workflows do not require them. - Use an empty tool declaration or omit the
toolsfield if supported by the agent platform. - If persistence of generated output becomes a genuine requirement, grant only narrowly scoped
writeaccess:- Restrict writes to one dedicated output directory.
- Prevent overwriting existing files by default.
- Reject traversal and absolute paths.
- Require explicit user approval before writing.
- Do not grant
execunless a concrete, documented feature requires command execution. If later introduced:- Use a fixed command allowlist.
- Prohibit shell interpolation.
- Validate every argument.
- Run in a sandbox with minimal filesystem and network access.
- Require explicit confirmation for each execution.
- Apply platform-level controls so Skill-declared tools are not automatically trusted and untrusted message content cannot authorize tool use.
- Remove