Over-Privileged Skill — Excessive Permissions
This detects AI 'skills' or plugins that ask for far more access than they need — blanket network access, wildcard file paths, or write access to an agent's core identity/memory files. Once approved, these permissions often persist without further review, giving an attacker a long-lived foothold.
How the attack works
An attacker packages a skill that requests broad, vaguely-justified permissions such as network:true, wildcard file globs like ~/*, or write access to files that define the agent's identity or memory (e.g. SOUL.md, MEMORY.md). Some variants go further and try to flip auto-approve settings, such as writing chat.tools.autoApprove:true into an editor's configuration file, so future privilege escalations skip user review entirely. Because many platforms only ask for consent once at install time, the skill keeps this access indefinitely — a 'consent gap' the attacker exploits to avoid repeated prompts. From there, the skill can exfiltrate API keys, PII, or tamper with the agent's own instructions and memory.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a627a5e5-1bb3-499b-99fc-83eda21b3e1d
- Severity
- High
- CVEs
- CVE-2025-53773
Why it matters
An organization can lose control over what an AI agent is permitted to do, exposing credentials, personal data, or the agent's own behavioral rules to silent, persistent manipulation — without any additional approval step to catch it.
What you can do
- →Review skill permission requests line by line before approval; reject blanket network access or wildcard file paths not clearly justified by the skill's stated function.
- →Never allow skills write access to identity/memory files (SOUL.md, MEMORY.md, agent config) unless that is their explicit, sole purpose.
- →Disable or tightly control auto-approve settings for tool/agent permission escalation, and audit config files (like .vscode/settings.json) for unexpected changes.
- →Re-review permissions periodically rather than relying on one-time install consent, especially after skill updates.
Known benign look-alikes
- System administration skills that need broad access by design
- Skills documenting security settings without modifying them
- A security audit report that discusses over-privileged skill patterns and references SOUL.md file protections without containing actual write commands
- DevOps documentation explaining how to scope Bash tool access and avoid wildcard permissions in skill manifests