T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:31- Finding
Automatic Disclosure of User ZIP Code to Third-Party Services
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31-37
Vulnerability Type: Automatic transmission of sensitive location data
Risk Level: MediumCode Snippet:
markdown ##### find_stores Find nearby Kroger-family stores. The user's location (zip code) is injected automatically by the platform. **Required parameters:** None (zip code is injected automatically)Technical Analysis
The
find_storesaction automatically injects the user's ZIP code even though location is not represented as an explicit action parameter. The Skill then instructs the Agent to invoke this action as the mandatory first step in grocery-search workflows.A ZIP code is approximate location data and may reveal a user's residence, workplace, or current travel area. Its use is functionally relevant to finding nearby stores, but automatic injection prevents the Agent and user from reviewing or minimizing the information before transmission. The documentation does not specify whether explicit consent is obtained, which parties receive the ZIP code, how long it is retained, or whether it is included in logs.
This design therefore exceeds a strict consent-based least-privilege model. The store-search operation needs a search area, but it does not inherently require silently obtaining the location associated with the user's account. A manually supplied ZIP code or coarse location would provide the same core functionality with greater user control.
Attack Path
- A user asks the Agent to search for grocery products or nearby Kroger stores.
- The Skill requires the Agent to begin with
find_stores. - The platform retrieves and injects the user's ZIP code without exposing it in the action parameters.
- The resulting request is sent through AgentPMT and potentially onward to Kroger infrastructure.
- AgentPMT, downstream providers, or compromised service-side logging systems can associate the location with the use ...[truncated 906 chars]
- Remediation
View remediation
Remediation Suggestions
- Expose the ZIP code as an explicit
find_storesparameter rather than injecting it invisibly. - Obtain clear user confirmation before transmitting account-derived location information.
- Allow users to enter a different ZIP code so that an account address is not required.
- Use only the minimum location precision necessary for store discovery.
- Document all recipients of the location data, including AgentPMT and downstream Kroger services.
- Document retention, logging, deletion, and privacy-policy details.
- Avoid including location information in prompts, diagnostic output, analytics, and application logs unless strictly necessary.
- Permit product-detail searches that do not require local availability without first invoking
find_stores.
- Expose the ZIP code as an explicit