T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:8
- Finding
- Overprivileged Tool Configuration Enables Unnecessary Shell Execution and File Modification## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: Excessive tool permissions that violate least privilege **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml allowed-tools: Read, Write, Edit, Glob, Grep, Bash, WebSearch, WebFetch ``` ### Technical Analysis The skill requests `Write`, `Edit`, and `Bash` capabilities even though its declared function is to adapt conversational identity perspectives, read bundled reference material, and optionally verify facts online. Those capabilities are not required for the documented workflow. In particular, `Bash` provides a general-purpose local command-execution channel, while `Write` and `Edit` permit filesystem modification. This conflicts with the project's stated read-only operating model: ```markdown 参考身份库 `references/identity-matrix.md` 为可选参考、运行时只读：叠加/卸载/唤醒是会话内状态，不修改库文件、不回写叠加记录。 ``` The project contains no scripts or implementation that directly exercises these permissions. Therefore, this finding concerns exposed capability and attack surface rather than evidence that commands are currently executed maliciously. Nevertheless, making unnecessary privileged tools available weakens isolation and could let adversarial input steer the agent into operations beyond the skill's legitimate purpose. ### Attack Path 1. The skill is loaded, making all tools listed in `allowed-tools` available to the agent. 2. An attacker submits a task, embedded instruction, or indirect prompt that requests a shell command or filesystem modification. 3. Because `Bash`, `Write`, and `Edit` are authorized at the skill level, the agent may invoke them despite those operations being unrelated to identity stacking. 4. Depending on runtime sandboxing and the agent's effective account permissions, the operation could execute local commands or alter accessible files. No automatic trigger, persistence mechanism, or remote payload retrieval behavior was found in the reviewed project. ### Impact Asses ...[truncated 722 chars]
- Remediation
- ## Remediation Suggestions 1. Apply least privilege by removing tools unnecessary for the declared workflow: ```yaml allowed-tools: Read, Glob, Grep, WebSearch, WebFetch ``` 2. Remove `Bash`, `Write`, and `Edit` unless a concrete, documented feature requires them. 3. Consider omitting `WebSearch` and `WebFetch` by default and enabling them only when the user explicitly requests current factual verification. 4. If future functionality genuinely requires file modification: - Restrict writes to a dedicated application-owned directory. - Require explicit user confirmation before every mutation. - Reject absolute paths and path traversal sequences. - Prevent modification of skill definitions, reference files, executable files, configuration, and startup locations. 5. If shell execution becomes necessary: - Replace general-purpose `Bash` access with narrowly scoped tools. - Use fixed executable allowlists and structured arguments. - Prohibit shell interpolation and dynamic command construction. - Run commands in a sandbox with minimal filesystem and network access. 6. Add automated validation that rejects tool declarations exceeding those required by the documented execution framework.