T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- references/game-design.md:45
- Finding
- Overbroad Long-Term Memory Access and User Profiling<![CDATA[ ## Vulnerability Details **File Location**: `references/game-design.md:45-55` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```text Before scoring destinations, generate them dynamically from memory: 1. Read long-term memory and recent chat 2. Infer user profile: - home region or cultural context - `user_language` (`zh` | `en` | `mixed`) - favorite topics - disliked topics - travel pace preference - recent curiosity spikes 3. Pick a chapter that best matches the profile now 4. Ask the model to propose `3-6` candidate destinations for that chapter 5. Score the generated pool and pick the best option ``` Related instructions reinforce this behavior at `references/game-design.md:127` and `assets/output-templates.md:20,121` by directing the Agent to select content from user memory and identity information. ### Technical Analysis The Skill requires the Agent to inspect long-term memory and recent conversation history, then infer a profile containing the user's home region, cultural context, interests, dislikes, behavioral preferences, and identity-related information. The instruction does not restrict access to data created by this Skill or to information explicitly supplied for the current game session. This violates least-privilege principles because a fictional travel game only needs limited gameplay state and voluntarily provided preferences. If the host exposes cross-session or cross-skill memory, the Skill can consume information originating from unrelated interactions without a purpose-specific consent boundary. The issue does not constitute memory poisoning because the reviewed instructions do not write attacker-controlled rules into persistent memory. No evidence was found that the collected profile is transmitted externally, used to obtain operating-system privileges, or exposed through command execution. ### Attack Path 1. A user explicitly activ ...[truncated 1661 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace unrestricted long-term-memory access with Skill-scoped state containing only necessary gameplay fields, such as current chapter, bond level, language, and destinations already visited. 2. Use preferences only when the user explicitly provides them during an active Claw Go session or affirmatively opts into persistent personalization. 3. Define an allowlist of permitted fields and prohibit reading unrelated memories, identity attributes, private conversations, credentials, health information, financial information, or precise location data. 4. Avoid inferring home region, cultural context, or identity unless the user directly supplies that information for a clearly stated gameplay purpose. 5. Add a consent prompt before enabling cross-session personalization and provide controls to inspect, correct, disable, and delete stored game preferences. 6. Apply retention limits and namespace all persistent state under the Skill so that other conversation history is not queried. 7. Use neutral defaults when Skill-specific memory is unavailable instead of searching broader conversation history. 8. Revise the instruction to a least-privilege form, for example: ```text Use only preferences explicitly provided in the active Claw Go session or stored in the user-approved Claw Go state. Do not inspect unrelated conversations or general long-term memory. If no approved preferences exist, select a neutral starter chapter and ask one optional preference question. ``` ]]>