T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:23- Finding
Wildcard CLI Permission Exposes Administrative and Credential-Management Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:23-28; supporting tool definitions intools.md:75-77,tools.md:159-161, andtools.md:2939-3031
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: HighVulnerable Code
markdown | Property | Value | |----------|-------| | **name** | so-me-studio | | **description** | Schedule posts, manage inbox, generate AI content, and automate social-media operations across 10+ platforms | | **allowed-tools** | Bash(so-me:*) |The wildcard includes sensitive operations documented in
tools.md:markdown | `invite_team_member` | Invite a new member to the workspace | email | | `remove_team_member` | Remove a member from the workspace | memberId | | `update_member_role` | Update a team member's role | memberId, role |markdown | `list_api_keys` | List active API keys for the current workspace | _none_ | | `create_api_key` | Create a new API key; full key is returned only once | name | | `revoke_api_key` | Revoke an API key | id |The exposed profile-management schema also permits sensitive identity changes:
json { "name": "update_profile", "description": "Update the authenticated user's profile", "inputSchema": { "type": "object", "properties": { "name": { "type": "string", "description": "Display name" }, "password": { "type": "string", "description": "New password" }, "timezone": { "type": "string", "description": "IANA timezone" }, "email": { "type": "string", "description": "Email address" } } } }Technical Analysis
The declared functionality primarily concerns social-media scheduling, inbox management, content generation, analytics, and media handling. However,
Bash(so-me:*)permits every command made available by the CLI.That permission includes operations capable of:
- Changing the aut ...[truncated 2123 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
Bash(so-me:*)with an explicit allowlist containing only commands necessary for the declared workflows. - Separate ordinary operations from elevated administration:
- Default: account listing, drafts, posts, analytics, media, and inbox reads.
- Confirmation-required: publishing, replying, deleting content, and sending WhatsApp messages.
- Disabled by default: API-key management, password/email changes, role management, tenant deletion, account disconnection, and bulk deletion.
- Require explicit, task-specific user confirmation immediately before every irreversible or access-control-changing action.
- Never allow instructions found in inbox messages, comments, generated content, or API responses to authorize administrative commands.
- Apply server-side role checks and short-lived, narrowly scoped credentials so client-side mistakes cannot obtain workspace-administrator privileges.
- Redact credentials returned by
create_api_keyfrom logs, transcripts, shell history, and model-visible output. - Add automated policy tests that reject any newly introduced CLI command unless it has been reviewed and assigned an appropriate privilege tier.
- Replace