Security audit · 技能安全扫描(免费版)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:13
Finding: Excessive Filesystem and Command-Execution Permissions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 13-15
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml
tools: - read - exec - write

Technical Analysis

The Skill declares unrestricted filesystem reading, filesystem writing, and command execution. Its documented functionality only performs an HTTPS request to https://scanner.pyxmate.com/api/v1/check/ using a supplied owner/name identifier and processes the resulting security scores.

General-purpose read, write, and exec capabilities are not necessary for that operation. A constrained network-request capability restricted to the documented API host would be sufficient. Granting broader tools increases the authority available to the Skill and violates the principle of least privilege.

The Markdown does not directly instruct the Agent to abuse these tools, so exploitation would depend on the hosting Agent exposing the declared permissions and accepting malicious or misdirected instructions. Nevertheless, the unnecessary permissions materially increase the consequences of prompt injection, compromised context, or future malicious modifications to the Skill.

Attack Path

A user loads the Skill on an Agent platform that grants the tools listed in its metadata.

The Skill consequently receives filesystem read/write and shell-command execution capabilities.

Attacker-controlled input, injected content, or a later malicious change directs the Agent to invoke one of those tools rather than only querying the scanner API.

The read tool can be used to access files available to the Agent, including configuration or credential files.

The write tool can alter files within the Agent process's operating-system permissions.

The exec tool can execute arbitrary local commands under the Agent's account, potentially combining local data acce ...[truncated 658 chars]
Remediation: View remediation
Remediation Suggestions

Remove read, write, and unrestricted exec from the declared tools.

Replace them with a dedicated HTTP-request capability restricted to:

HTTPS only;

the exact host scanner.pyxmate.com;

the path prefix /api/v1/check/;

the required HTTP method, preferably GET;

bounded response sizes and reasonable timeouts.

Validate owner and name against a strict allowlist pattern before constructing the request path, and URL-encode each path component.

Do not permit arbitrary callback destinations unless callback support is implemented with strict URL validation and protections against server-side request forgery.

If command execution is unavoidable on a platform lacking a network tool, use a fixed wrapper rather than a user-constructed shell command. Pass validated values as separate arguments and enforce an executable and destination allowlist.

Explicitly disclose that the supplied skill identifier is sent to a third-party service.

Remove the undocumented API_KEY configuration requirement unless authentication is genuinely required. If it is required, document the precise authentication mechanism and ensure the key is never placed in URLs, logs, command output, or scanner payloads.

Enforce operating-system sandboxing, minimal filesystem access, blocked subprocess creation, and egress filtering as defense-in-depth controls.

技能安全扫描(免费版)

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Intent-Code Divergence

Missing User Warnings

Context-Inappropriate Capability