T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:87
- Finding
- Broad Agent Memory Access for Feishu Folder Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:87-91`; `references/feishu-doc-recipe.md:17-20` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:87-91`: ```markdown | Key | Location | Description | |-----|----------|-------------| | User profile | `meals/profile.yaml` | Taste preferences and constraints | | Receipts folder | Feishu drive | Token stored in MEMORY.md | | Meal history | `meals/history.yaml` | Past menus to avoid repeats | ``` From `references/feishu-doc-recipe.md:17-20`: ```markdown ## 2. Create Document Receipts folder token: check MEMORY.md for `receipts 文件夹 token`. ``` ### Technical Analysis The skill directs the agent to inspect the general-purpose `MEMORY.md` persistent-memory file to obtain a Feishu folder token. A general memory file may contain unrelated conversation state, identifiers, credentials, private user details, or persistent instructions. Reading the entire resource for one configuration value violates least-privilege and data-minimization principles. The folder token is legitimately needed to place the generated document in the requested directory. The weakness is not the use of that token itself, but the instruction to retrieve it from a broad persistent-memory resource rather than a dedicated configuration or secret store. No evidence shows that the skill explicitly transmits unrelated memory contents or intentionally abuses them. Nevertheless, loading those contents into the active agent context makes them available to later model reasoning, search operations, or API requests. ### Attack Path 1. A user activates the weekly-menu skill. 2. The skill instructs the agent to locate the receipts-folder token in `MEMORY.md`. 3. The agent reads the general memory resource rather than a narrowly scoped configuration entry. 4. Unrelated sensitive state enters the active model context. 5. A later prompt, untrusted sea ...[truncated 633 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Move the receipts-folder token into a dedicated, narrowly scoped configuration entry, such as `meals/config.yaml`, with restrictive filesystem permissions. 2. Prefer a platform-managed secret or connector configuration that exposes only the required folder identifier. 3. Do not instruct the agent to read the complete `MEMORY.md` file. 4. If migration cannot occur immediately, use a deterministic parser that retrieves only the named field without placing the rest of the file into the model context. 5. Document the exact configuration field and validate that it contains a correctly formatted Feishu folder token before use. 6. Separate persistent conversational memory from operational configuration and credentials. ]]>