T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:33- Finding
Unnecessary Filesystem and Command-Execution Permissions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 33-36
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeTechnical Analysis
The skill declares
read,exec, andwriteaccess even though its stated purpose is to generate natural-language tarot readings. That functionality does not require filesystem access or local command execution.In particular, the
execpermission creates an unnecessary command-execution channel, whilereadandwriteallow the agent to inspect or alter local files. The document's later references to anMD+EXECclassification and network diagnostics do not establish a legitimate requirement for these capabilities.This violates the principle of least privilege. The declaration alone does not prove that malicious commands are currently executed, but it materially increases the consequences of prompt injection, ambiguous operational instructions, or future changes to the skill.
Attack Path
- The skill is loaded with
read,write, andexectools enabled. - An attacker supplies crafted user input, or attacker-controlled content is introduced into the conversation.
- The content attempts to persuade the agent that reading files, writing output, or executing a command is necessary for the tarot request.
- If the agent follows those instructions without adequate authorization checks, it invokes one or more unnecessarily available tools.
- Tool invocation could expose local data, modify files accessible to the agent, or execute commands with the privileges of the hosting process.
This is a conditional exploitation path: successful exploitation depends on the host agent's tool authorization controls and resistance to prompt injection.
Impact Assessment
Potential impact is limited by the operating-system privileges and sandbox applied to the agent process. In an insufficiently iso ...[truncated 518 chars]
- The skill is loaded with
- Remediation
View remediation
Remediation Suggestions
- Remove all tool permissions because the advertised tarot-reading functionality can be implemented entirely through language-model generation:
yaml tools: []-
If the hosting platform permits omission, remove the
toolsfield instead of declaring an empty list. -
Remove or revise documentation that classifies the skill as requiring command execution.
-
Remove network-diagnostic instructions such as running
ping; they are unrelated to the skill's legitimate function. -
Do not add persistence for saving readings unless it is explicitly required. If storage is later introduced:
- Request narrow, purpose-specific storage access.
- Require explicit user consent before saving content.
- Restrict writes to a dedicated application directory.
- Prevent arbitrary paths and path traversal.
- Define retention and deletion controls.
-
Enforce host-level safeguards independently of the skill declaration:
- Require confirmation before command execution.
- Sandbox the agent with minimal filesystem access.
- Apply command and path allowlists.
- Deny access to credentials, configuration secrets, and unrelated user files.
- Log and review sensitive tool invocations.