T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Excessive Filesystem Permissions Violate Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```yaml allowed-tools: Bash(curl:*) Bash(node:*) Read Write Edit Grep ``` ### Technical Analysis The Skill’s declared purpose is to submit URL-mapping requests to the XCrawl API. Its documented workflow requires network access through `curl` or `node` and read access to `~/.xcrawl/config.json` for the API key. The declared `Write`, `Edit`, and broad `Grep` capabilities are not required by that workflow. They allow the Agent to search, create, or modify accessible local files even though the Skill performs a read-only mapping operation. This also conflicts with the Skill’s own tool policy at lines 34–35, which says to request runtime permissions for `curl` and `node` only. The API key’s transmission to the explicitly documented HTTPS endpoint is necessary for the declared service and was not identified as credential exfiltration. The security issue is the unrelated local filesystem authority granted alongside that network operation. ### Attack Path 1. A user activates the Skill for an XCrawl mapping task. 2. The Skill makes `Read`, `Write`, `Edit`, and `Grep` available in addition to its required network tools. 3. Malicious, injected, or mistakenly interpreted instructions direct the Agent to search local files or modify files unrelated to mapping. 4. The Agent uses `Grep` or `Read` to discover accessible local information and `Write` or `Edit` to alter accessible files. 5. These operations occur under the host Agent’s filesystem privileges, exceeding the authority required for the requested mapping task. This path is conditional on the Agent following malicious or erroneous instructions; the audited file does not itself direct the Agent to perform those operations. ### Impact Assessment Successful exploitation could expose the contents and names of files accessib ...[truncated 465 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `Write`, `Edit`, and `Grep` from `allowed-tools`, because they are not required for URL mapping. 2. Retain only one necessary network execution path where possible, rather than granting both broad `curl` and `node` execution. 3. Replace unrestricted `Read` access with a narrowly scoped mechanism that can read only `~/.xcrawl/config.json`. 4. Constrain outbound requests to `https://run.xcrawl.com/v1/map` and reject redirects to unapproved origins so the authorization header cannot be forwarded inadvertently. 5. Keep the API key solely in the authorization header and ensure command output, error messages, and logs never print it. 6. Align the manifest permissions with the documented policy that only the minimum runtime permissions should be requested. 7. If the platform cannot enforce path- or endpoint-level restrictions, require explicit user approval before each filesystem read or network request involving credentials. A hardened declaration should expose only the minimum tools needed to read the XCrawl configuration and submit the documented HTTPS request. ]]>