other
Warning
- Location
- SKILL.md:18
- Finding
- Overbroad Access to Sensitive Cross-Agent Conversation History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–44 **Vulnerability Type**: `other: Sensitive Conversation History Access` **Risk Level**: Medium ### Complete Code Snippet ```markdown It is READ-ONLY and never modifies any data store. By default it queries EVERY agent whose data exists on this machine; restrict with `--source`. ## When to use Use it proactively when the user: - Refers to earlier work: "之前/上次/我们讨论过/已经配置过", "what did we do", "recall". - Asks to find a past command, error+fix, file change, or decision. - Starts research you may have already done in a prior session. Check history FIRST in these cases — it is cheaper than re-researching. ## Scope: project vs global `sessions` and `grep` default to the **current project** — sessions whose working directory is the current directory or a subdirectory of it. Sibling **git worktrees** of the same repo are included automatically, so a session run in a linked worktree still shows up from the main checkout (and vice versa). To widen or narrow: - `--global` / `-g` — search ALL sessions across every directory. - `--dir <path>` — scope to a specific directory instead of the cwd. - `--no-worktrees` — strict single-directory scope (don't expand to worktrees). Rule of thumb: start project-scoped (more relevant, less noise); if you find nothing, retry with `--global`. ``` ### Technical Analysis The Skill is intended to recover information from previous coding-agent conversations. Project-scoped history access is consistent with this purpose, but the instructions authorize querying every installed agent and recommend falling back to a global search across all directories when a project-scoped search returns no result. Conversation histories can contain credentials, proprietary code, personal information, internal file paths, command output, and details from unrelated projects. Searching all agents or directories without explicit consent exceeds the minimum access normally necess ...[truncated 2182 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before accessing any stored conversation history. 2. Keep all searches limited to the current project by default. 3. Do not automatically fall back to `--global`; request separate confirmation before searching unrelated directories, worktrees, or agents. 4. Allow users to select the specific source, project, directory, session, and time range to be searched. 5. Display metadata or redacted previews before loading complete message content. 6. Detect and redact likely credentials, private keys, tokens, personal data, and other secrets before returning historical content. 7. Treat all retrieved messages as untrusted reference data, not as instructions with authority over the current session. 8. Clearly disclose which sources and directories will be searched and record an audit trail of history access. 9. Apply strict result limits and retrieve only the individual parts necessary to answer the request. ]]>