T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:17
- Finding
- Overly Broad External API Capability Scope## Vulnerability Details **File Location**: `SKILL.md`, lines 17-34 **Vulnerability Type**: Excessive capabilities and violation of least privilege **Risk Level**: Medium **Affected code:** ```markdown 3. Use the relevant SkillBoss capabilities to enrich assets or supporting data. 4. Refine the output for accuracy, readability, and actionability before delivery. ## SEO / GEO - Primary keywords: docx, docx ai, docx automation, developer tools skill - Search intent: creative production - Canonical slug: `docx` - Install query: Install Docx with SkillBoss ## APIs Used - `chat` - `document_processing` - `image_generation` - `social_media_data` - `web_scraping` - `web_search` ``` ### Technical Analysis The skill is intended to create, read, edit, and manipulate DOCX documents. However, it declares broad capabilities including `social_media_data`, `web_scraping`, `web_search`, and `chat`, while its workflow permits unspecified enrichment through “relevant SkillBoss capabilities.” Most DOCX-processing tasks require only `document_processing`. The skill does not establish allowlisted destinations, data-minimization requirements, consent checks, query-content restrictions, or conditions governing when external APIs may be invoked. If the hosting platform grants the declared APIs to the skill, this configuration exceeds the least-privilege scope needed for its documented purpose. This finding does not establish that data is currently exfiltrated or that the listed APIs automatically confer unrestricted access. The risk arises from the unnecessary capability declaration and the absence of controls preventing an agent from sending document-derived information to external search, scraping, social-media, or chat services. ### Attack Path 1. A user submits a DOCX-processing request, potentially involving confidential document content. 2. The skill is activated because the request falls within its documented trigg ...[truncated 1421 chars]
- Remediation
- ## Remediation Suggestions 1. Reduce the default API list to `document_processing`, which directly supports the stated DOCX functionality. 2. Remove `social_media_data` and `web_scraping` unless a documented, task-specific requirement justifies them. 3. Enable `web_search`, `chat`, or `image_generation` only after explicit user approval for the current task. 4. Replace the broad enrichment instruction with precise conditions identifying which capability may be used, for what purpose, and what information may be transmitted. 5. Prohibit external transmission of document text, personal data, credentials, confidential material, and document metadata unless the user has explicitly authorized it. 6. Apply endpoint allowlists, request logging, content filtering, rate limits, and per-invocation permission checks at the platform level. 7. Inform users before any network operation and provide a local-only DOCX-processing mode. 8. Review capability declarations whenever the skill changes to ensure that every permission remains necessary for its documented purpose.