T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unnecessary Bash Permission Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill grants access to `Bash`, although its documented purpose is limited to preparing advertising creative briefs. The documented workflow consists of clarifying campaign requirements, generating content, enriching assets, and refining the output; it does not identify any legitimate need to execute operating-system commands. Bash access allows commands to run with the permissions of the account hosting the agent. This unnecessarily expands the skill's authority and violates the principle of least privilege. The declaration does not itself execute commands and no malicious command is embedded in the reviewed file. Nevertheless, the excessive capability could turn malicious or prompt-injected instructions into local command execution. ### Attack Path 1. An attacker introduces crafted instructions through campaign requirements, referenced content, or another untrusted input processed while this skill is active. 2. The crafted content instructs the agent to invoke Bash under the guise of gathering supporting data or enriching campaign assets. 3. Because `Bash` is explicitly permitted, the agent may execute the injected command. 4. The command could access files, alter data, invoke installed programs, or communicate with external systems, subject to the hosting process's operating-system privileges and any external sandbox restrictions. This path requires the agent to follow attacker-controlled instructions; the audited file contains no direct command invocation or confirmed exploitation logic. ### Impact Assessment Successful exploitation could provide command execution within the security context of the agent process. Potential scope includes reading files available to that account, modifying ...[truncated 265 chars]
- Remediation
- ## Remediation Suggestions Remove `Bash` from `allowed-tools` because no shell operation is required by the documented workflow: ```yaml allowed-tools: Read ``` Also remove `Read` if the skill does not need to process local files. If future functionality genuinely requires command execution, replace unrestricted Bash access with a narrowly scoped tool that exposes only the required operation. Validate untrusted campaign content before using it in tool calls, require explicit user approval for consequential actions, and enforce runtime sandboxing with minimal filesystem and network permissions.