T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Unnecessary Shell Access Violates Least-Privilege Requirements## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: Excessive tool permission **Risk Level**: Medium **Relevant Code Snippet**: ```yaml --- name: Generate Operations Ad Creative Brief > 📖 **Complete setup guide**: https://skillboss.co/skill.md description: "Plan campaign visuals and hooks for operations promotions. Use when working on paid campaign planning for operators, agencies, business teams." > 📖 **Complete setup guide**: https://skillboss.co/skill.md allowed-tools: Bash, Read ``` ### Technical Analysis The skill explicitly grants access to the `Bash` tool, although its documented workflow only involves clarifying campaign requirements, generating advertising content, using chat or image-generation capabilities, and refining the resulting brief. The package contains no scripts, build steps, or other functionality that legitimately requires shell command execution. Granting an AI agent shell access unnecessarily violates the principle of least privilege. Campaign descriptions and other user-provided content are potentially untrusted. If such content contains prompt-injection instructions and the runtime permits the declared tools, the agent could be induced to invoke Bash for actions unrelated to generating an advertising brief. No malicious shell command or automatic Bash invocation is present in the reviewed files. Exploitation therefore depends on adversarial input, the agent following that input, and the runtime honoring the declared Bash permission. ### Attack Path 1. A user or external campaign document supplies adversarial instructions as part of the advertising-brief request. 2. The skill processes that content while operating with its declared `Bash` permission. 3. The adversarial content instructs the agent to invoke Bash under a pretext such as gathering campaign data or enriching creative assets. 4. If the agent complies and the host provides no additional s ...[truncated 941 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `Bash` from the skill's `allowed-tools` declaration. 2. Retain `Read` only if the skill must consume local campaign documents; otherwise remove it as well. 3. Explicitly permit only the narrowly scoped chat and image-generation interfaces required by the documented workflow. 4. If shell access becomes necessary in a future version, expose a constrained wrapper that permits only predefined operations rather than arbitrary commands. 5. Require explicit user approval for any command execution, filesystem modification, or outbound network operation. 6. Run the skill in a sandbox with restricted filesystem access, blocked access to credentials, and deny-by-default network controls. 7. Treat campaign briefs and referenced documents as untrusted data and ensure their contents cannot redefine tool permissions or execution policy.