T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Excessive Tool Permissions for a Content-Generation Skill## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: Excessive shell-execution and filesystem-read permissions **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill's documented purpose is to generate market-research advertising creative briefs. Its workflow consists of clarifying campaign requirements, producing and refining content, and optionally enriching supporting assets. None of these stated operations inherently requires arbitrary shell-command execution or unrestricted local-file access. Granting both `Bash` and `Read` violates the principle of least privilege: - `Bash` may allow the agent to execute local commands with the privileges of the hosting process. - `Read` may allow access to local files available to the hosting process. - Combining these capabilities increases the potential scope of prompt injection or compromised skill instructions because local data could be discovered, processed, and potentially exposed through available output channels. The audited package does not contain executable scripts or direct instructions that actively abuse these tools. The risk arises from unnecessary capability exposure rather than confirmed malicious execution. ### Attack Path 1. A user installs and invokes the skill. 2. The runtime grants the skill the declared `Bash` and `Read` capabilities. 3. Attacker-controlled content enters the interaction, such as campaign material containing prompt-injection instructions, or the skill's instructions are later compromised. 4. The injected instructions induce the agent to invoke `Read` against accessible local files or execute commands through `Bash`. 5. Commands run and files are accessed with the permissions of the agent-hosting process. 6. Retrieved information may be disclosed through the agent's response or another channel available to the runtime. This path depends on the runtime honoring the declared permiss ...[truncated 801 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both unnecessary permissions from the skill manifest: ```yaml allowed-tools: [] ``` Alternatively, omit `allowed-tools` if the platform defaults to no tool access. 2. If supporting assets must be read, replace unrestricted access with a narrowly scoped read capability limited to an explicit workspace directory and approved file types. 3. Do not grant `Bash` unless a documented workflow strictly requires command execution. If it becomes necessary: - Allowlist exact commands and fixed arguments. - Disable shell metacharacters, pipelines, redirection, and command substitution. - Run commands in a sandbox with minimal filesystem and network access. - Use a dedicated low-privilege account. - Require user confirmation before every invocation. 4. Treat campaign briefs, uploaded documents, and other user-provided content as untrusted data. Explicitly prohibit following tool-use instructions embedded in that content. 5. Add automated manifest checks that reject tool permissions unsupported by the documented skill workflow.