T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:11- Finding
Excessive Command Execution and File-Write Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
rust-free
Security checks for vulnerabilities and agentic risk
Overview
This Rust guidance skill is not malicious, but it needs Review because it requests write and command-execution authority while giving inconsistent and under-scoped descriptions of file, API, network, and command behavior.
Review this before installing if you only wanted a passive Rust explainer. Do not give it administrator/root access or API keys unless the publisher clarifies exactly which commands, files, callbacks, and services are used. If installed, run it only in a sandboxed project and approve any file change or command explicitly.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requests exec capability even though its stated purpose is Rust pitfall guidance and code review. Unnecessary command execution materially increases the risk of arbitrary shell actions, local data exposure, and destructive side effects if the skill is triggered by adversarial or ambiguous input.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill defines a callback_url for asynchronous completion but later claims it does not support asynchronous processing. This inconsistency obscures network behavior and may cause users to permit outbound callbacks or expose endpoints without understanding when external requests occur.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation gives conflicting statements about whether an API key is required, which can mislead users about what external services are contacted and what secrets may be needed. In a skill with read/write/exec capabilities, this ambiguity weakens trust boundaries and can cause users to expose credentials unnecessarily or misconfigure the skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Claiming there are no external dependencies while elsewhere describing API integration and API-related failures is materially inconsistent. This can hide the real attack surface, including outbound data transfer, service trust assumptions, and credential handling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest presents the skill as Rust guidance, but later expands its behavior into generic file handling, API integration, and command execution. This scope drift is dangerous because users may invoke a seemingly harmless educational skill while unintentionally granting it broader operational authority over the filesystem, network, and shell.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises file writing, external API use, and command execution but does not give a clear, prominent warning about their effect on user data and systems. This creates a consent and transparency failure: users may expect passive analysis while the skill can perform active operations with side effects.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill's display name, summary, and description are entirely in Chinese, and the document does not indicate any language choice or opt-in for users. Under the policy, forcing a specific language without offering a locale option can be a natural-language policy violation.
- Content