T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:65
- Finding
- Unrestricted Automatic Access to Agent Memory with External Transmission## Vulnerability Details **File Location**: `SKILL.md`, lines 65-73 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Relevant excerpt translated into English:** ```text Task name: Morning report Execution time: Every day at 07:30 Execution content: Read yesterday's memory, generate a report, and send it through Feishu Notification channel: Feishu message ## Notes - When a task executes, it automatically reads related files (memory/yesterday.md) - Important failed tasks are automatically retried, up to three times - Task execution results are recorded in logs ``` ### Technical Analysis The Skill documentation instructs scheduled tasks to access Agent memory automatically and permits the resulting report to be transmitted through Feishu. It does not require explicit authorization for each memory source, define a strict path allowlist, limit which data may be extracted, or require redaction before external transmission. The phrase “related files” is broader than the specific scheduling function requires. Consequently, an implementation following these instructions could cross least-privilege boundaries by reading sensitive memory content unrelated to the requested task. Recording task results in logs introduces an additional location where extracted information could persist. The package contains only documentation and metadata, so the reviewed files do not demonstrate an executable implementation of this behavior. The risk arises from the documented behavior that an Agent or downstream implementation may follow. ### Attack Path 1. A user or attacker creates a recurring report task that requests information derived from Agent memory. 2. The task executes unattended at its scheduled time. 3. Following the Skill instructions, it reads `memory/yesterday.md` or other files considered “related.” 4. Sensitive content from those files is incorporated into the generat ...[truncated 995 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before a scheduled task reads any memory file or transmits generated content externally. 2. Replace “related files” discovery with an exact allowlist of approved paths, normalized and validated against a fixed memory directory. 3. Apply least privilege by granting each task access only to the specific files required for that task. 4. Display the selected source files, destination, and generated report in a confirmation preview before enabling recurring execution. 5. Detect and redact credentials, access tokens, personal information, and other secrets before reports are transmitted or logged. 6. Record only minimal operational metadata in logs; do not log memory contents or complete outbound messages by default. 7. Validate Feishu recipients and require confirmation when a destination changes. 8. Ensure retries are idempotent and do not resend a message unless delivery status is known. 9. Maintain an audit trail identifying the task owner, approved files, destination, execution time, and authorization decision. 10. Provide a mechanism to revoke file and notification permissions independently for every scheduled task.