T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:129- Finding
Overbroad Access to Persistent Agent and User Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 129-136 and 169-179
Vulnerability Type: Excessive access to persistent memory and user-context files
Risk Level: MediumRelevant Skill Instructions:
markdown ### 4. Memory/Context Files (if using ai-persona-os) **Locations:** - `MEMORY.md` — Permanent facts - `memory/[today].md` — Session notes - `USER.md` — User preferencesmarkdown ### Step 1: Gather Data Sources Check for these files in order:- todo.md (to-do list from ai-meeting-notes)
- meeting-notes/ folder (recent meeting notes)
- MEMORY.md (if using ai-persona-os)
- memory/[today].md (session notes)
- Calendar integration (if available)
text Technical Analysis
The Skill instructs the agent to inspect persistent memory, session notes, and user-preference files when producing a daily briefing. These files can contain personal facts, prior conversation details, confidential business information, or unrelated sensitive context.
The instructions do not define field-level restrictions, require explicit consent before accessing persistent context, or limit processing to content marked as suitable for a briefing. Consequently, the agent may load substantially more information than is necessary to summarize tasks, meetings, and calendar events. This conflicts with least-privilege and data-minimization principles.
The access is conditional on the relevant integration being present, and the package contains no code that bypasses operating-system permissions. It also contains no instruction to transmit the collected information to an external service. The risk is therefore confined to overbroad local information access and possible disclosure through generated output rather than privilege escalation at the operating-system level.
Attack Path
- A user installs or activates the Skill in a workspace containing
MEMORY.md,memory/[today].md, or ` ...[truncated 1203 chars]
- Remediation
View remediation
Remediation Suggestions
- Make persistent-memory access opt-in and request explicit user authorization before the first read.
- Use a dedicated briefing data file containing only information approved for daily summaries.
- Restrict reads to explicitly marked sections, such as
briefing_context, rather than loading entire memory or user-profile files. - Define an allowlist of permitted fields and exclude credentials, secrets, private conversation history, financial information, and unrelated personal records.
- Add a relevance filter so only information directly connected to current tasks, deadlines, meetings, or user-selected priorities can be included.
- Present the list of intended data sources to the user and allow each source to be enabled or disabled independently.
- Prevent verbatim reproduction of persistent-memory content unless the user explicitly requests it.
- Document retention and disclosure boundaries, including that persistent context must not be copied into generated briefings when other users may view the output.