Generate Boutique Fitness Studio Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

The skill's handout-generation purpose is ordinary, but it grants shell and file-read access that is not explained by the artifact.

Review this skill before installing. Its business purpose appears benign, but users should prefer a version that removes Bash and Read or clearly limits them to specific, user-approved files and commands needed for the handout workflow.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Code Snippet:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill is intended to generate a client education handout, and its documented API requirements are limited to chat and image_generation. Nevertheless, its configuration authorizes Bash and Read.

Shell access can permit arbitrary local command execution within the privileges of the agent process, while filesystem-read access can expose files unrelated to handout generation. The documented workflow does not establish a legitimate requirement for either capability. This unnecessarily expands the skill's attack surface and violates the principle of least privilege.

No malicious commands, credential-access logic, or direct exploitation instructions were found in the reviewed file. Exploitation would therefore depend on the agent being induced to misuse these granted tools, such as through malicious or untrusted task content.

Attack Path

1. A user or external content source supplies crafted instructions as part of a handout-generation request.
2. Those instructions attempt to persuade the agent to inspect local files or execute shell commands.
3. Because the skill explicitly permits Read and Bash, the agent may invoke those tools despite their being unnecessary for the stated task.
4. Commands execute with the operating-system privileges of the hosting agent, or local files become accessible to the active session.
5. Retrieved information could subsequently be included in generated output or otherwise disclosed, depending on the surrounding agent runtime and safeguards.

Impact Assessment

Successful exploitation could allow command execution and filesystem access within the privilege boundary of the agent process. The practical scope depends on runtime sandboxin ...[truncated 385 chars]

Remediation

View remediation

Remediation Suggestions

Remove Bash and Read from allowed-tools unless a concrete, documented workflow requires them. Restrict the skill to the minimum capabilities needed for text and image generation.

If filesystem access later becomes necessary:

• Permit access only to an isolated workspace containing task-specific assets.
• Apply path allowlists and block traversal outside that workspace.
• Deny access to credentials, environment files, user home directories, and system configuration.
• Prefer a narrowly scoped asset-reading tool over general filesystem access.

If command execution is unavoidable:

• Replace unrestricted shell access with a purpose-built tool exposing only required operations.
• Enforce strict argument validation and fixed executable allowlists.
• Run commands in a sandbox with no network access, minimal filesystem mounts, and an unprivileged account.
• Require explicit confirmation for security-sensitive operations.
• Treat all user-provided and externally retrieved content as untrusted instructions.
• Log tool calls and test that handout-generation prompts cannot trigger unrelated file access or command execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.