T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:42- Finding
Excessive Local Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 42–46
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - glob - grepTechnical Analysis
The Skill describes a search assistant whose primary responsibilities are decomposing research questions, invoking a general web-search agent, and aggregating search results. These activities do not inherently require arbitrary command execution or broad access to the local filesystem.
Nevertheless, the Skill declares the
exec,read,glob, andgreptools. In particular,execcan provide a general command-execution channel, while the other tools can support filesystem discovery and inspection. The only documented command-line use is an optional recommendation to runpingfor network troubleshooting at line 409. That narrow diagnostic purpose does not justify unrestricted command execution.This configuration violates the principle of least privilege. Because the Skill processes untrusted user queries and externally sourced search content, malicious or adversarial content could attempt to influence the Agent into invoking these unrelated local tools. The project does not contain embedded scripts or an explicit malicious command, so exploitation depends on the hosting Agent honoring the declared permissions and being susceptible to adversarial instructions.
Attack Path
- A user submits an adversarial research query, or a search result contains prompt-injection instructions.
- The search assistant processes the attacker-controlled content while aggregating results.
- The content induces the Agent to inspect the host or execute a command under the pretext of completing the research task or validating connectivity.
- The Agent uses
globto identify files,readorgrepto inspect their contents, orexecto run a local command. ...[truncated 939 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
exec,read,glob, andgrepfrom the declared tool list because they are not required for query decomposition, web searching, or result aggregation. - Declare only the narrowly scoped web-search or search-agent capability needed by the Skill.
- If webpage retrieval is required, use a constrained WebFetch facility that:
- Accepts only HTTP and HTTPS URLs.
- Blocks loopback, link-local, private-network, and cloud metadata addresses.
- Enforces response-size and timeout limits.
- Treats retrieved content as untrusted data rather than executable instructions.
- If connectivity diagnostics are genuinely necessary, replace unrestricted
execaccess with a dedicated connectivity-check operation that accepts no arbitrary command or shell syntax. - Require explicit user approval for any exceptional local filesystem or command operation.
- Run the Skill in a sandbox with minimal filesystem visibility, no unnecessary credentials, restricted network access, and an unprivileged operating-system identity.
- Add an explicit instruction that user input and retrieved webpages must never authorize local commands, filesystem access, credential access, or changes to Agent behavior.
- Remove