T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unnecessary Bash Permission Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill grants access to the `Bash` tool even though its documented purpose is limited to producing advertising creative briefs and planning campaign visuals. The workflow does not identify any legitimate need to execute local commands. Furthermore, the APIs declared by the skill are `chat` and `image_generation`, which reinforces that shell access is unrelated to the advertised functionality. Bash access can permit arbitrary command execution with the privileges of the process hosting the agent. Although `SKILL.md` does not directly instruct the agent to execute a malicious command, exposing an unnecessary execution-capable tool increases the consequences of malicious user input, indirect prompt injection, or incorrect agent behavior. ### Attack Path 1. The skill is loaded and grants the agent access to the `Bash` tool. 2. An attacker supplies campaign requirements, referenced content, or other input containing instructions designed to induce shell execution. 3. The agent follows the injected or misleading instructions and invokes Bash because the skill permits it. 4. Commands execute under the host agent's operating-system identity. 5. Depending on host permissions and sandboxing, the commands could read or modify accessible files, inspect environment variables, execute local programs, or communicate with external systems. This path requires the agent to be induced into invoking Bash; the audited file does not itself contain an automatic execution instruction or payload. ### Impact Assessment Successful exploitation could provide access to all files, processes, credentials, and network resources available to the host agent's operating-system account. The exact scope depends on external sandboxing a ...[truncated 181 chars]
- Remediation
- ## Remediation Suggestions Apply least privilege by removing `Bash` from the tool allowlist: ```yaml allowed-tools: Read ``` Retain `Read` only if the skill must inspect local brand assets or supporting documents. If no local files are needed, remove that permission as well. Explicitly permit only the chat and image-generation capabilities required by the documented workflow. Additional hardening measures include: - Run any execution-capable tools in a restricted sandbox if shell access is added in the future. - Require explicit user confirmation before executing commands or accessing sensitive files. - Restrict filesystem, environment-variable, process, and network access at the runtime level. - Treat campaign text, referenced documents, and retrieved content as untrusted data rather than executable instructions. - Keep the declared tool permissions synchronized with the workflow and API documentation.