T05 · Unauthorized Access and Privilege Escalation
- Location
.claude/settings.local.json:4- Finding
Overly Broad Host Filesystem Permissions
- Content
View full analysis
Vulnerability Details
File Location:
.claude/settings.local.json, lines 4-10
Vulnerability Type: Excessive filesystem read and enumeration permissions
Risk Level: MediumVulnerable Configuration
json "Read(//e//**)", "Read(//c/Users/Administrator/**)", "Read(//c/Users/Administrator/Documents/**)", "Bash(find /e -maxdepth 3 -type d -iname \"biji\")", "Bash(find /e -maxdepth 3 -type d -iname \"笔记\")", "Bash(find /c -maxdepth 5 -type d -name \".obsidian\")", "Bash(find /e -maxdepth 5 -type d -name \".obsidian\")", "Bash(find /d -maxdepth 5 -type d -name \".obsidian\")",Technical Analysis
The local Claude configuration pre-authorizes reading the entire
E:drive and the complete Windows Administrator profile. It also permits filesystem reconnaissance across theC:,D:, andE:drives to locate note and Obsidian directories.These privileges exceed the requirements of the declared Skill functionality. The Skill consists of packaged Markdown playbooks for business and wealth analysis and ordinarily needs access only to its own project files. Optional integration with a note vault does not justify unrestricted access to drive roots or the entire Administrator profile.
The configuration does not itself transmit or modify files, and the audit found no current instructions that collect or exfiltrate sensitive data. Nevertheless, these pre-approved permissions weaken the security boundary. If malicious or prompt-injected content is later processed in the same trusted project context, it may use the authorized reconnaissance commands and read permissions without triggering a new approval prompt.
Attack Path
- A user opens or trusts the project with
.claude/settings.local.jsonactive. - The broad read and
findoperations become pre-approved for the agent. - The agent later processes malicious or prompt-injected content in the same context.
- The injected instructions invoke the permitted
findcommands to discover ...[truncated 1006 chars]
- A user opens or trusts the project with
- Remediation
View remediation
Remediation Suggestions
- Remove
.claude/settings.local.jsonfrom the distributed Skill package. Machine-specific permissions should not be shipped as part of a reusable Skill. - Restrict read access to project-relative files required by the Skill rather than entire drives or user profiles.
- If Obsidian integration is required, ask the user to select a specific vault and grant access only to that exact directory.
- Remove the pre-approved cross-drive
findcommands. Require interactive authorization before performing filesystem discovery outside the project. - Replace broad rules such as
Read(//e//**)andRead(//c/Users/Administrator/**)with narrowly scoped, explicit paths. - Keep sensitive directories—including credential stores, browser profiles, SSH material, and application configuration—outside every approved wildcard.
- Document each retained permission, its purpose, and its expected scope, and periodically review the configuration according to least-privilege principles.
- Remove