T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unnecessary Shell Capability Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4` **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium **Complete Code Snippet**: ```yaml allowed-tools: Bash, Read ``` ### Technical Analysis The skill declares access to the `Bash` tool even though its documented purpose is to generate SaaS advertising creative briefs. None of the workflow steps in `SKILL.md` require command execution, system administration, package installation, or shell-based processing. Exposing a general-purpose shell unnecessarily increases the skill's authority and violates the principle of least privilege. If attacker-controlled campaign content, copied reference material, or another instruction source successfully influences the agent, the unnecessary Bash permission could provide a path from prompt-level manipulation to local command execution. The declaration does not itself prove that commands are automatically executed. Exploitation depends on the hosting agent honoring this permission and being induced to invoke Bash. ### Attack Path 1. A user supplies attacker-controlled campaign text, reference material, or other content to the skill. 2. The content includes instructions designed to make the agent treat shell execution as part of generating or enriching the creative brief. 3. The agent follows the injected instructions and invokes the allowed `Bash` tool. 4. Commands execute with the operating-system privileges and filesystem access of the agent process. 5. Depending on the runtime sandbox, the attacker may read accessible files, modify workspace content, invoke installed programs, or make network requests through available system utilities. ### Impact Assessment Successful exploitation could obtain the effective privileges of the agent process through shell command execution. The affected scope may include readable files, writable project or user directories, environment variables, installed command-line tools, and network resources ...[truncated 291 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `Bash` from `allowed-tools` because it is not required by the documented workflow: ```yaml allowed-tools: Read ``` - If local file access is also unnecessary, remove `Read` and expose no tools by default. - If a future feature genuinely requires command execution, replace unrestricted Bash access with a narrowly scoped tool that validates arguments and permits only specific operations. - Run the skill in a sandbox with minimal filesystem permissions, restricted network access, a sanitized environment, and no inherited credentials. - Require explicit user confirmation before any command execution. - Treat campaign briefs, copied web content, and reference files as untrusted data rather than executable instructions. ]]>