T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/execute.sh:8- Finding
Mutable Permission Configuration Enables Unrestricted Command Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Her Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a self-evolving memory agent that discloses powerful abilities, but its command execution and mutable permission design are too broad for safe default installation.
Install only in a sandboxed workspace with no inherited credentials or sensitive files. Do not enable full permission mode unless you intentionally want arbitrary local command execution, and treat the memory/config files as persistent state that can affect future behavior.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This mismatch is security-relevant because the skill is presented as a benign cognitive assistant while also describing shell execution, filesystem access, and permission gating through local config. Users may underestimate the operational risk and grant or invoke the skill in contexts where command execution and file access can cause system or data compromise.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file explicitly claims a limited permission model while the capabilities block permits general execution and process-related behavior, which effectively bypasses the apparent command allowlist. In an agent skill, this contradiction is dangerous because security controls may rely on the declared policy, while the actual runtime can still execute broader actions than expected.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
Enabling self_evolve/self-modification allows the agent to change its own behavior over time, which can undermine review, reproducibility, and safety constraints after deployment. In combination with execution, process, memory, and web capabilities, self-modification increases the risk that the agent expands its behavior beyond originally audited limits or incorporates unsafe logic from untrusted inputs.
- Content
json "sessions_spawn": true, "memory_search": true, "web_search": true, "self_evolve": true } }
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The comments state the script is used for safe shell execution, but the implementation allows arbitrary command execution in full mode, creating a misleading safety boundary. This mismatch can cause reviewers or users to trust the script more than they should, increasing the chance that dangerous command execution is enabled without proper scrutiny.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises file read/write and broader execution capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. This creates ambiguity for reviewers and increases the risk that a host agent enables powerful tools without clear least-privilege boundaries, especially given the skill also describes self-modification and command execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill instructions and behavior description are presented entirely in Chinese, with no indication that language choice is user-selectable or that the locale restriction is intentional and justified. This can constitute a language/locale policy issue because the skill appears to impose a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly lists file writes, shell execution, internet access, sub-agent spawning, and self-modification, yet provides no clear warning about possible data loss, code execution, network exposure, or persistent system changes. In context, this is dangerous because the skill frames these abilities as normal evolution features, which can normalize high-risk actions and reduce informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The configuration presents a constrained model through a limited permission level and narrow allowed command list, but elsewhere enables broad execution features including exec, process spawning, session spawning, and web search. This mismatch can mislead operators, policy layers, or users into trusting a capability boundary that does not actually exist, increasing the chance of unsafe code execution or external data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON config includes the core thinking chain and execution flow entirely in Chinese, indicating a language-specific skill configuration with no visible opt-in, fallback, or justification for restricting language/locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script rewrites the JSON config file and later appends to an evolution history file, which are safety-relevant persistent state changes. Although there are status messages like 'Starting evolution' and 'Evolution complete', there is no explicit disclosure that running the script will modify specific files under the user's workspace or append historical records.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script grants arbitrary command execution via
exec "$@"wheneverpermission_levelis set tofull, which exceeds a narrowly scoped 'safe execution' helper and creates a direct pathway to run destructive or exfiltrating commands. In an agent skill context, this is especially dangerous because configuration-driven privilege changes can silently expand the agent from a constrained helper into a general shell executor.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script executes arbitrary commands immediately in full-permission mode without any confirmation, interactive warning, or secondary authorization check. In a self-evolving agent advertised as having memory and autonomous behavior, this increases the risk of silent harmful actions such as file deletion, credential access, or persistence if configuration is changed or abused.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a self-evolving agent with thinking chain, memory management, continuous learning, and a Claude Code-inspired execution flow. In this file, the implemented behavior is limited to initializing files, recording interactions, appending learning notes, printing growth status, and adding graph entries; there is no thinking-chain execution, autonomous behavior, or substantive learning logic beyond storing user-provided text.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script's natural-language comments and default topic are entirely in Chinese, including the default learning topic and note headings, with no indication that other languages are supported. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script’s natural-language comments describe the skill as a Chinese-language self-reflection script and the generated reflection text is also fixed in Chinese. This indicates a language choice is being imposed without any visible opt-in, fallback, or justification for a region-specific constraint, which matches the language/locale policy violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language comments are written only in Chinese, which signals a fixed language choice without any opt-in or indication that the skill is region-specific. Under the stated policy, forcing a specific language without user choice or justification is a locale-policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script writes a timestamped activity record to evolutions.jsonl, creating a persistent log of behavior. While logging itself is not inherently unsafe, the file operation lacks a specific warning that user or agent activity metadata will be stored on disk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The script accesses a configuration file under a user home directory to derive permission level, which is sensitive local state that affects execution behavior. While comments describe reading permissions, there is no explicit user-facing disclosure that the script inspects this local configuration before acting.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description explicitly includes an emotion system as part of the skill's capabilities. This script merely initializes an empty emotions.jsonl file and contains no commands or logic that manipulate or consult emotion data, so the claimed behavior is not actually implemented here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script creates and overwrites a markdown file via shell redirection, which is a user-data write operation. Although it logs after the fact that the file was created, there is no upfront disclosure or warning in the script comments around the behavior, and the file write could replace existing content for the same date.
- Content