T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:42- Finding
Unnecessary Command-Execution Capability Violates Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 42–44; related declarations at lines 242 and 251
Vulnerability Type: Excessive tool permission
Risk Level: MediumVulnerable Code
yaml tools: - read - exec - writeRelated command-execution declarations and instructions:
markdown - **Classification**: MD+EXEC (pure Markdown instructions; some functions require exec command-line execution capability)markdown | Network error | Connection timed out or unreachable | Execute ping commands to test network connectivity, check firewall and proxy settings, then execute ping commands again and retry the command, referring to domestic alternatives |Technical Analysis
The Skill's stated purpose is text and single-file translation. Language-model inference is sufficient for text translation, while file translation requires only narrowly scoped read and write access. Nevertheless, the Skill declares the general-purpose
exectool and explicitly directs the Agent to invoke command-line network diagnostics.This violates the principle of least privilege because arbitrary command execution is broader than the permissions legitimately required for translation. It is also inconsistent with the statements at lines 54 and 238 that the Skill does not call an external translation API. No malicious command, command-injection payload, or remote payload retrieval was identified, so the finding concerns excessive capability rather than confirmed malicious execution.
Attack Path
- An Agent loads the Skill and grants the tools declared in its metadata.
- The Skill consequently receives
execcapability despite translation not requiring it. - A network error, whether genuine or incorrectly inferred, activates the troubleshooting instruction at line 251.
- The Agent runs command-line network diagnostics such as
ping. - Host command execution and network interactio ...[truncated 757 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execfrom the declared tool list:yaml tools: - read - write - Change the
MD+EXECclassification to a Markdown-only classification with narrowly scoped file access. - Remove the
pingtroubleshooting instruction. Because the Skill uses the Agent's built-in LLM and no external translation API, network diagnostics are not part of its legitimate workflow. - Restrict reads to the exact source file selected by the user.
- Restrict writes to a derived language-suffixed output path, require confirmation before overwriting an existing file, and reject path traversal outside the authorized workspace.
- If command execution is retained for an independently justified feature, use a strict command allowlist, prohibit shell interpretation, validate every argument, impose timeouts, and require explicit user approval before execution.
- Remove