T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Overbroad Access to Persistent Memory and Cross-Session History## Vulnerability Details **File Location**: `SKILL.md`, lines 13–18 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Required Data Sources (in this order) 1. Earliest and recent `memory/YYYY-MM-DD*.md` files (find first/last dates). 2. `MEMORY.md` for long-term milestones. 3. Available session inventory/history (main + sub-agent sessions when accessible). 4. Current conversation/tool logs. ``` ### Technical Analysis The skill instructs the agent to collect information from persistent memory files, long-term memory, main and sub-agent session histories, and conversation and tool logs. These sources can contain private conversations, credentials included in commands, internal filesystem paths, personal information, or records unrelated to the requesting user or current task. Although this access is directly related to constructing a lifetime history, the instructions do not establish least-privilege boundaries. They do not require explicit authorization for cross-session or sub-agent access, limit collection to a user-selected date range, distinguish records belonging to different users, or require sensitive-data redaction before disclosure. This creates an authorization and privacy-boundary risk when the runtime makes these sources accessible to the skill. ### Attack Path 1. A user invokes the skill by requesting a complete lifetime history. 2. The skill instructs the agent to search persistent memory files and `MEMORY.md`. 3. The agent accesses available main-session and sub-agent histories. 4. The agent examines current conversation and tool logs. 5. Information from these sources is consolidated into a single chronological response. 6. Sensitive or unrelated historical information may be disclosed if the sources contain credentials, private conversations, personal data, or records associated with another context. Exploitation depends on the runtime granting ...[truncated 510 chars]
- Remediation
- ## Remediation Suggestions 1. Default to current-session history and require explicit user confirmation before accessing persistent memory, prior sessions, or sub-agent records. 2. Ask the user to select the desired date range, sessions, and data-source categories. 3. Verify that requested records belong to the authorized user and context before reading or disclosing them. 4. Apply secret and personal-data redaction to command arguments, tokens, passwords, private keys, environment variables, and unrelated conversation content. 5. Summarize sensitive operational records rather than reproducing their raw contents. 6. Require separate authorization before accessing sub-agent histories. 7. Document the exact sources accessed and identify records omitted for privacy or authorization reasons. 8. Add a rule prohibiting disclosure of credentials or unrelated third-party information even when such content appears in an authorized history source.