T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Unrestricted Access to Host-Side User Context## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: Unauthorized access to host-side user context **Risk Level**: Medium **Complete Code Snippet**: ```markdown **First:** Read `USER.md` for context — current role, industry, experience level, career goals. ``` ### Technical Analysis The Skill unconditionally instructs the agent to read `USER.md` before handling a request. This file is not part of the audited package, so the instruction targets a host-side resource that may contain persistent profile data, personal preferences, or other information unrelated to career guidance. The instruction does not: - Request the user's explicit consent before accessing the file. - Restrict access to specific career-related fields. - Require redaction or minimization of unrelated personal information. - Limit use of the retrieved data to the current task. - Prevent sensitive content from appearing in generated résumés, cover letters, outreach messages, or other responses. This violates the principle of least privilege because many supported operations—such as explaining an interview question or providing a generic negotiation framework—do not require access to the user's entire persistent context. No instruction to transmit the contents to an external service was identified. Therefore, the finding is overbroad local resource access and potential disclosure through generated output, not confirmed external data exfiltration. ### Attack Path 1. A user installs or activates the Skill. 2. The Skill's mandatory first instruction causes the agent to access the host-side `USER.md`. 3. The entire file, including potentially unrelated personal information, enters the active model context. 4. The user requests a career artifact such as a résumé, cover letter, company brief, or outreach message. 5. Information obtained from `USER.md` influences the generated artifact or is inadvertently reproduced ...[truncated 866 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional instruction to read `USER.md`. 2. Ask the user directly for the minimum career information required for the requested operation. 3. If persistent context can improve the result, obtain explicit consent before accessing it and explain which fields are needed. 4. Use a narrowly scoped career profile rather than reading a general-purpose user context file. 5. Apply field-level data minimization, limiting access to items such as current role, experience level, target role, industry, and career goals. 6. Instruct the agent not to use or reproduce unrelated personal, financial, health, authentication, or contact information. 7. Require user review before incorporating context-derived personal information into materials intended for external distribution. 8. Ensure host-level permissions deny Skills access to persistent user files by default unless the user grants task-specific authorization.