T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unnecessary Shell Capability Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium **Complete Code Snippet**: ```yaml --- name: Generate Healthcare Ad Creative Brief description: "Plan campaign visuals and hooks for healthcare promotions. Use when working on paid campaign planning for healthcare operators, clinic teams, patient..." allowed-tools: Bash, Read metadata: ``` ### Technical Analysis The Skill declares access to the arbitrary shell-execution tool `Bash`, although its documented purpose is limited to producing healthcare advertising creative briefs. The workflow contains no legitimate requirement to execute operating-system commands. This violates the principle of least privilege. If attacker-controlled content, prompt injection, or future modifications influence the Skill, the unnecessary shell capability could become an execution channel. No malicious shell command or confirmed active exploitation is present in the audited file; the vulnerability is the excessive permission exposed by its configuration. ### Attack Path 1. The Skill is loaded and receives the tools declared under `allowed-tools`. 2. The runtime grants it access to `Bash`. 3. Attacker-controlled task content or injected instructions induce the agent to invoke shell commands. 4. Those commands access host resources outside the legitimate healthcare brief-generation workflow. 5. The resulting scope depends on the operating-system privileges, filesystem access, network access, and sandbox restrictions of the agent process. ### Impact Assessment Successful abuse could permit command execution with the privileges of the hosting agent process. Depending on runtime controls, this may expose readable local files, allow filesystem modification, invoke installed network utilities, or interact with other host resources. The issue does not independently demonstrate privilege escalation beyond ...[truncated 78 chars]
- Remediation
- ## Remediation Suggestions Remove `Bash` from `allowed-tools` because the documented workflow does not require shell execution: ```yaml allowed-tools: Read ``` Retain `Read` only if the Skill must consume local campaign materials. Otherwise, remove that permission as well. Explicitly allow only the chat and image-generation capabilities required by the stated workflow. If shell access later becomes necessary, expose narrowly scoped operations instead of unrestricted Bash and enforce sandboxing, filesystem boundaries, network restrictions, command allowlisting, and human approval for sensitive actions.