T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Excessive Shell and File-Read Permissions## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool authorization violating least privilege **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill is intended to generate content-marketing advertising briefs, visuals, and hooks. Its documented workflow does not require local shell execution or unrestricted filesystem access. Nevertheless, the configuration authorizes both `Bash` and `Read`. This violates the principle of least privilege. If the hosting agent permits these tools to be invoked while processing attacker-controlled campaign requirements, prompt content could induce the agent to read local files or execute shell commands unrelated to brief generation. The declaration does not itself execute commands, and successful exploitation depends on the host agent's tool controls and instruction handling, but it unnecessarily exposes high-impact capabilities. ### Attack Path 1. An operator installs or loads the skill, granting its declared `Bash` and `Read` tools. 2. An attacker supplies campaign content or task instructions containing adversarial directions. 3. The agent interprets those directions as requiring local file inspection or command execution. 4. The agent invokes `Read` to access local data or `Bash` to run an unintended command. 5. Tool-accessible information may be exposed, or commands may execute with the privileges of the agent process. ### Impact Assessment Exploitation could provide access to files readable by the agent process and permit command execution under that process's operating-system account. The potential scope includes project files, environment-accessible data, credentials stored in readable files, and modification of resources writable by the process. It does not inherently grant privileges beyond the agent process or establish persistence. No actual malicious command, ...[truncated 97 chars]
- Remediation
- ## Remediation Suggestions - Remove `Bash` and `Read` from `allowed-tools` because the documented marketing-brief workflow does not require them. - Permit only the narrowly scoped chat and image-generation capabilities needed by the skill. - If file input becomes necessary, require explicit user selection and restrict reads to an approved workspace or allowlist. - If command execution becomes essential, replace general shell access with a purpose-built tool exposing only fixed operations and validated arguments. - Enforce host-level confirmation for sensitive file access and command execution. - Treat campaign text and other user-supplied content as untrusted data, and prevent it from changing tool authorization or system-level instructions.