T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Overly Broad Shell and File-Read Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11` **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill grants access to both shell execution (`Bash`) and local-file reading (`Read`). Its documented purpose is to generate advertising creative briefs for legal services, and the declared workflow does not identify any legitimate need to execute system commands or inspect arbitrary local files. This violates the principle of least privilege. Although the reviewed skill contains no instruction that directly abuses these tools, making them available unnecessarily increases the impact of malicious user input, prompt injection, or untrusted content introduced during a skill session. ### Attack Path 1. A user activates the skill to generate a legal-services advertising brief. 2. Malicious or injected content instructs the agent to inspect local files or execute a shell command as part of the requested workflow. 3. Because `Read` and `Bash` are explicitly allowed, the agent may treat those operations as authorized. 4. The attacker could cause unauthorized file disclosure or command execution within the permissions of the agent process. No automatic exploitation path or malicious shell command was found in the reviewed files; exploitation depends on untrusted instructions reaching an agent that honors the broad tool declaration. ### Impact Assessment Successful exploitation could allow reading files accessible to the agent process and executing commands under that process's operating-system account. The exact scope depends on the host sandbox, filesystem permissions, command-execution controls, and approval requirements. No privilege-escalation mechanism beyond the agent process's existing privileges was identified. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `Bash` and `Read` from `allowed-tools` because they are not required by the documented creative-brief workflow. - Permit only the narrowly scoped chat and image-generation capabilities needed for the task. - If file access becomes necessary, restrict it to an explicit project directory and allow only required file types. - If shell access becomes unavoidable, replace unrestricted shell execution with a purpose-built tool that validates arguments and permits only specific operations. - Require explicit user confirmation for access to sensitive files or command execution. - Run the skill in a sandbox with minimal filesystem, network, environment-variable, and operating-system privileges. ]]>