Excessive Permission Grant in Skill Manifest
Some AI 'skills' or plug-ins declare permissions in their manifest or system prompt that go well beyond what their stated job requires — things like wildcard file access or full system control. This is a sign the skill is either poorly designed or intentionally built to gain more access than it should have.
How the attack works
A skill is published or installed with a manifest or system prompt describing what it does and what access it needs. The declared permissions include wildcards, 'full access', or system-level scope that has no clear connection to the skill's stated purpose. Because agent frameworks often grant whatever a manifest requests, this over-broad grant becomes the skill's actual runtime capability. An attacker who controls or later modifies such a skill can use that standing over-permission to reach data or systems the skill was never meant to touch.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e8a2d756-9f6b-4a3e-e8a7-2f5b0a7f6c49
- Severity
- Medium
Why it matters
An over-permissioned skill gives an attacker a ready-made escalation path: once the skill runs, it already has more access than the task needs, so no further exploit is required to reach sensitive data or systems.
What you can do
- →Review skill manifests and system prompts before installation and reject wildcard or 'full access' permission requests that aren't justified by the task.
- →Apply least-privilege scoping to every skill; require explicit, itemized permissions instead of broad categories.
- →Maintain an allowlist of approved skills and re-review manifests whenever a skill is updated.
- →For legitimate admin tools that need broad access, document the justification and monitor their usage separately from other skills.
Known benign look-alikes
- Legitimate admin tools that require broad access by design