T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Unnecessary Shell and Filesystem Permissions## Vulnerability Details **File Location**: `SKILL.md:8` **Vulnerability Type**: Excessive tool authorization **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill is intended to generate an estate-planning client education handout. Its documented workflow requires content generation and optionally image generation, but it grants access to unrestricted shell execution through `Bash` and local filesystem access through `Read`. These permissions are not justified by the documented task and violate the principle of least privilege. If attacker-controlled content, a malicious external instruction, or prompt injection influences the agent while this skill is active, the unnecessary tools could provide a path to execute local commands or read files unrelated to handout generation. The permission declaration does not itself execute commands, and no malicious shell command is included in the audited package. The risk arises from the unnecessary capabilities made available during skill operation. ### Attack Path 1. A user loads the skill to generate an estate-planning handout. 2. The agent processes attacker-controlled or otherwise untrusted content, such as supplied source material or external instructions. 3. The content instructs the agent to inspect local files or execute shell commands under the pretext of completing the handout. 4. Because `Read` and `Bash` are authorized, the agent may perform actions beyond the skill's legitimate purpose. 5. Accessible local information may be disclosed, or commands may execute with the privileges of the agent process. ### Impact Assessment Successful exploitation could permit reading files available to the agent process and executing operating-system commands with that process's privileges. The precise scope depends on runtime sandboxing, filesystem permissions, command approval controls, and the identity under which the a ...[truncated 94 chars]
- Remediation
- ## Remediation Suggestions - Remove `Bash` and `Read` from `allowed-tools` because the documented handout-generation workflow does not require them. - Authorize only the narrowly scoped chat and image-generation capabilities needed for the task. - If local document input is genuinely required, replace general filesystem access with a user-selected, read-only input mechanism limited to approved files. - If shell execution later becomes necessary, allow only fixed commands with validated arguments inside a sandbox rather than granting general-purpose `Bash`. - Require explicit user confirmation before accessing local information or invoking any capability outside content generation.