T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Unnecessary Shell and Filesystem Permissions## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: Excessive tool permissions violating least privilege **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill grants access to arbitrary shell execution through `Bash` and local filesystem access through `Read`. Its stated purpose is to generate finance advertising creative briefs, and the documented workflow does not identify any operation that requires executing operating-system commands or reading local files. This creates an unnecessary privilege boundary expansion. If attacker-controlled prompt content, untrusted campaign material, or later-added remote instructions influence the agent, those permissions may be used outside the intended advertising workflow. `Read` could expose files available to the agent process, while `Bash` could execute commands with the operating-system privileges of that process. No malicious command or direct exploitation instruction is present in the reviewed package. Exploitation therefore depends on an additional prompt-injection or instruction-manipulation vector reaching the skill while these tools are enabled. ### Attack Path 1. A user loads the skill, causing the agent to receive the declared `Bash` and `Read` capabilities. 2. The agent processes attacker-controlled or otherwise untrusted campaign content. 3. Malicious content instructs the agent to perform actions unrelated to generating an advertising brief, such as reading configuration files or invoking shell commands. 4. Because the skill explicitly permits both tools, the agent may issue the requested filesystem or command-execution operations if platform-level safeguards do not block them. 5. Commands run with the privileges of the hosting agent process, and any readable data could potentially be incorporated into subsequent output or transmitted through other available channels. ### ...[truncated 698 chars]
- Remediation
- ## Remediation Suggestions Remove the unnecessary permissions: ```yaml allowed-tools: [] ``` If the platform supports narrower capability declarations, grant only the chat and image-generation operations explicitly needed by the documented workflow. Do not enable general-purpose shell or filesystem tools. Additional hardening measures should include: 1. Require explicit user approval before any future filesystem or command-execution operation. 2. Restrict file access to an isolated, task-specific workspace if reading assets later becomes necessary. 3. Replace arbitrary shell execution with narrowly defined, parameter-validated operations. 4. Run the skill in a sandbox using a minimally privileged operating-system account. 5. Treat campaign content and external instructions as untrusted data and prevent them from authorizing tool calls. 6. Add automated policy checks that reject tool declarations not justified by the documented workflow.