T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:8- Finding
Unnecessary Bash Permission Violates Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:8
Vulnerability Type: Excessive tool permission
Risk Level: Mediumyaml allowed-tools: Bash, ReadTechnical Analysis
The skill grants unrestricted Bash access even though its declared workflow only involves clarifying advertising requirements, drafting a real-estate creative brief, enriching supporting materials, and refining the result. No documented workflow step requires shell command execution.
This permission violates the principle of least privilege. While the reviewed skill contains no malicious shell command, granting Bash makes a command-execution capability available during skill operation. Malicious or untrusted task content could attempt to induce the agent to use that capability outside the legitimate creative-brief workflow.
Attack Path
- A user or system loads the skill, activating its declared Bash permission.
- The agent processes attacker-controlled or otherwise untrusted campaign content.
- That content attempts to persuade the agent to invoke Bash under the pretext of collecting assets, enriching supporting data, or completing the brief.
- If the induced tool call is accepted, shell commands execute with the operating-system privileges and sandbox access assigned to the agent process.
- The attacker may consequently access files, inspect the execution environment, or perform other commands permitted by that runtime.
This is a capability-enablement path rather than evidence of active exploitation: no shell invocation or malicious payload was found in the reviewed files.
Impact Assessment
Successful exploitation could provide command execution within the agent's runtime security boundary. The practical scope depends on external sandboxing and process privileges, potentially including readable or writable local files, environment information, network resources, and executable programs available to the agent. The rev ...[truncated 115 chars]
- Remediation
View remediation
Remediation Suggestions
Remove
Bashfromallowed-tools, because the documented workflow does not require command execution. RemoveReadas well unless processing local source documents is an explicit and necessary use case.Define the smallest possible tool allowlist and document why each retained capability is needed. If future functionality genuinely requires shell operations, replace unrestricted Bash access with a narrowly scoped tool that validates commands, arguments, file paths, and network destinations. Run such operations in a restricted sandbox with minimal filesystem permissions, no unnecessary credentials, controlled network access, execution timeouts, and audit logging.