AST03: Over-Privileged Skills
Risk Level: High
A skill is granted far broader permissions than its stated function needs: filesystem write where read would do, shell access for something that only calls an API, or the agent's shared credentials instead of its own scoped token. Nothing is wrong until the skill is weaponized by a prompt injection downstream, at which point the permission grant defines the blast radius.
Real-world evidence
Snyk identified more than 280 ClawHub skills exposing API keys and PII beyond their declared function. The AST10 project also cites a Meta researcher whose agent deleted a large volume of email unintentionally, which is over-privileged execution without any attacker involved.
The connection to LLM03
This is the skill-level expression of the same failure the LLM Top 10 ranks third as Excessive Agency. The difference is scope: LLM03 is about what the agent may do, AST03 is about what each individual skill inside it may do. An agent with tight permissions and one over-privileged skill is an over-privileged agent.
Mitigations
- Require every skill to declare a permission manifest covering files, network, shell, and tool access
- Issue per-skill scoped credentials instead of sharing one agent-level API key across every skill
- Enforce permissions at runtime, not just declaratively in the manifest
- Flag any skill requesting write access to agent identity or configuration files for elevated review
- Scope network access to an allowlist of specific domains
- Compare observed runtime behavior against the declared manifest and investigate the gap