T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:20
- Finding
- Overbroad Access to Workspace Files and Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, line 20 **Vulnerability Type**: Unauthorized access beyond task requirements **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 4. **Local Data**: Check workspace files or memory for known spots. ``` ### Technical Analysis The skill instructs the agent to inspect unspecified workspace files or agent memory while researching parking and resale opportunities. It does not limit access to a dedicated parking-data file, require explicit user authorization, or exclude credentials, private conversations, personal information, and unrelated project files. This violates the principle of least privilege because the legitimate task only requires narrowly scoped local parking data. If the executing agent has broad workspace or memory access, this instruction may cause unrelated sensitive information to enter the skill's analysis context. ### Attack Path 1. A user submits a parking or local resale request that activates the skill. 2. The workflow reaches the local-data step. 3. The agent searches unspecified workspace files or memory for potentially relevant information. 4. Broad matching or misleading content causes unrelated sensitive data to be treated as relevant. 5. That information may be included in the generated analysis or carried into subsequent interactions with external search, browser, marketplace, or social-media tools. Exploitation depends on the host agent having access to sensitive workspace files or persistent memory. The reviewed file does not itself grant additional operating-system permissions. ### Impact Assessment The instruction could expose information already accessible to the host agent, including unrelated workspace content, prior-session data, personal addresses, private listings, configuration details, or credentials. The scope is bounded by the permissions of the executing agent; no evidence was found that the skill independent ...[truncated 163 chars]
- Remediation
- ## Remediation Suggestions Replace unrestricted workspace and memory inspection with a least-privilege data-access policy: 1. Require explicit user consent before reading local data. 2. Restrict access to a user-selected file or a dedicated path such as `references/parking-spots.md`. 3. Disable agent-memory searches by default and only enable them when the user explicitly requests use of previously stored parking information. 4. Prohibit access to credentials, secret files, private conversations, configuration files, and unrelated workspace content. 5. Validate and minimize any local data before incorporating it into prompts sent to external tools. 6. Require user confirmation before disclosing locally sourced information to websites or third-party services. A safer instruction would be: ```markdown 4. **Local Data**: With explicit user consent, read only the user-selected parking-data file or `references/parking-spots.md`. Do not inspect unrelated workspace files, credentials, private conversations, or agent memory, and do not send local data to external services without confirmation. ```