T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
calibration/index.js:90- Finding
Unnecessary Enumeration of Installed Skills
- Content
View full analysis
0) { const conflicts = await env.checkSkillConflicts(installedSkills, 'gaokao-advisor'); if (conflicts.length === 0) { results.passed.push({ check: 'Skill compatibility', detail: `No conflicts with ${installedSkills.length} installed Skills` }); } else { conflicts.forEach(c => { results.warnings.push({ check: `Conflict: ${c.skill}`, detail: c.description, autoFixed: c.autoFixed || false }); }); } } ``` The English labels above represent the corresponding original localized report strings; the executable calls and control flow are unchanged. ### Technical Analysis Standard calibration obtains the complete list of installed Skills through `env.getInstalledSkills()` and passes that inventory to `env.checkSkillConflicts()`. The package's primary purpose is university admissions advising, which does not inherently require visibility into all other installed capabilities. The access is disclosed in `SKILL.md`, but disclosure does not make the operation necessary or least-privileged. The code does not constrain the inventory to relevant interfaces, request a boolean-only compatibility result, or sanitize conflict details before adding them to a report. Exploitation depends on the privileges and behavior of the host-provided `env` object. The package does not itself transmit the inventory over the network or modify installed Skills. ### Attack Path 1. An operator or automated installation process invokes standard or deep calibration. 2. Standard calibration calls `env.getInstalledSkills()`. 3. The host returns the Agent's installed-Skill inventory. 4. The complete inventory is supp ...[truncated 847 chars]- Remediation
View remediation