T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:38
- Finding
- Repository Modification and Git Commit Without an Explicit Approval Checkpoint## Vulnerability Details **File Location**: `SKILL.md`, lines 38-46 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### 文档输出 - 将验证通过的设计写入 `docs/plans/YYYY-MM-DD-<topic>-design.md` - 提交设计文档到 git ### 继续实施（如果需要） - 询问：「准备好开始实施了吗？」 - **REQUIRED SUB-SKILL:** 使用 `core-writing-plans` 创建详细实施计划 ``` ### Technical Analysis The Skill's primary purpose is collaborative brainstorming and design development. However, after validating a design, it instructs the Agent to write a file into the current repository and commit that file to Git. It does not require a separate, explicit authorization checkpoint immediately before either operation. Writing repository files and modifying Git history are state-changing actions that exceed the permissions required merely to discuss or present a design. The instruction to invoke the required `core-writing-plans` sub-Skill also expands execution beyond the behavior available for review in this package. The referenced sub-Skill is not included in the audited project, so its permissions and side effects cannot be verified here. The issue does not demonstrate operating-system privilege escalation or credential theft. Its scope is unauthorized use of repository write and version-control privileges already available to the Agent. ### Attack Path 1. A user invokes the Skill for brainstorming or design assistance. 2. The Agent gathers requirements and presents a design for validation. 3. Once the design is considered validated, the Skill directs the Agent to create a file under `docs/plans/`. 4. The Agent performs the write without obtaining explicit authorization specifically for repository modification. 5. The Agent creates a Git commit without a separate approval checkpoint or a mandated review of the staged diff. 6. If the implementation workflow continues, the Agent invokes `core-writing-plans ...[truncated 1049 chars]
- Remediation
- ## Remediation Suggestions 1. Present the proposed design document in the conversation before performing any file-system operation. 2. Require explicit user approval immediately before writing to `docs/plans/`. 3. Require a second, separate approval immediately before staging or committing changes. 4. Display the target path and complete diff before each repository mutation. 5. Stage only the generated file by using an explicit path rather than broad staging operations. 6. Check for existing staged changes and stop if unrelated changes are present. 7. Make the Git commit optional rather than mandatory, and allow the user to perform it manually. 8. Document the expected source, permissions, and side effects of `core-writing-plans`, or make invocation optional and subject to explicit consent. 9. Preserve the default brainstorming workflow as read-only unless the user clearly requests repository changes.