T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Unnecessary Shell and Filesystem Permissions Violate Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium **Complete Code Snippet**: ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill grants access to `Bash` and `Read`, although its documented purpose is to generate healthcare advertising creative briefs. The workflow consists of clarifying campaign requirements, drafting content, enriching assets, and refining the output. The only APIs explicitly identified in the skill are `chat` and `image_generation`. No documented workflow step requires arbitrary shell command execution or unrestricted local file reading. Granting these capabilities therefore exceeds the task's legitimate requirements and violates the principle of least privilege. In particular, `Bash` can provide broad command-execution access under the host agent's operating-system identity, while `Read` may expose files available to that identity. The repository does not contain an instruction that directly abuses these permissions. Exploitation would require malicious or untrusted input, external content, or another prompt-injection source to influence the tool-enabled agent. ### Attack Path 1. The skill is loaded and grants the agent access to `Bash` and `Read`. 2. The agent processes attacker-controlled campaign input or untrusted supporting content. 3. That content injects instructions requesting shell execution or access to local files. 4. Because the unnecessary tools are authorized, the agent may invoke them despite their being unrelated to advertising-brief generation. 5. Commands execute, or files are read, with the permissions of the process hosting the agent. ### Impact Assessment Successful exploitation could allow access to locally readable files and execution of commands within the privileges of the agent host. Depending on the runtime environment, this could expose configuration files, proje ...[truncated 430 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash` and `Read` from `allowed-tools` because they are not required by the documented workflow. 2. Authorize only the narrowly scoped `chat` and `image_generation` capabilities needed to produce the advertised deliverable. 3. If future functionality genuinely requires file access, grant access only to explicitly approved files or directories and prefer a constrained read-only interface over unrestricted filesystem access. 4. If command execution becomes necessary, replace general-purpose shell access with a dedicated tool that validates arguments, restricts executable commands, enforces timeouts, and runs in a sandbox with minimal operating-system privileges. 5. Require user confirmation before any operation that reads local sensitive data or invokes external processes. 6. Add tests or policy checks that reject skill manifests requesting tools not demonstrably required by their documented workflows.