T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:17
- Finding
- Unnecessary Shell Access Violates Least-Privilege Principles## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium **Code Snippet**: ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill requests access to the `Bash` tool even though its documented purpose is to generate an educational handout. The workflow only describes clarifying requirements, drafting content, enriching assets, and refining the result. It does not identify any operation that legitimately requires shell-command execution. Granting Bash access expands the skill's authority beyond its stated functional requirements. If instructions in the skill, user-provided content, or externally sourced material influence the agent to issue shell commands, those commands would run with the operating-system privileges of the hosting agent process. ### Attack Path 1. A user installs and invokes the skill. 2. The agent grants the skill access to both `Read` and `Bash`. 3. Malicious or compromised instructions—potentially from user-controlled input or an external guide—induce the agent to invoke Bash. 4. Shell commands execute with the permissions available to the agent process. 5. Depending on host-level controls, those commands could read or modify accessible files, invoke installed programs, or initiate outbound network operations. ### Impact Assessment Successful exploitation could expose all files, commands, and network capabilities available to the agent's operating-system account. The exact scope depends on sandboxing and host configuration. The declaration does not itself elevate the process to administrator privileges, but it unnecessarily exposes a powerful execution channel that could be used to affect data outside the handout-generation task.
- Remediation
- ## Remediation Suggestions - Remove `Bash` from `allowed-tools`. - Grant only the tools strictly required to produce the handout. - If a future feature genuinely requires command execution, document the exact use case and replace unrestricted shell access with a narrowly scoped operation. - Enforce runtime sandboxing, filesystem restrictions, outbound-network controls, and explicit user confirmation for any command-execution capability. - Add tests that verify the skill can complete its documented workflow without invoking a shell.