T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:137- Finding
Undeclared Persistent Write to the Installed Skill Directory
- Content
View full analysis
此技能为纯文档/流程技能，不修改系统配置或执行外部命令。 ``` ### Technical Analysis The workflow instructs the Agent to update experience notes under the installed Skill's own `references/` directory. However, the permission declaration limits filesystem writes to the project working directory and states that writes are used to generate requirement documents. Writing to the Skill installation is outside that declared scope and violates least-privilege expectations. It also creates persistent state outside the audited project. Although the instruction does not explicitly request malicious content, credentials, or executable modifications, project-derived information written into a shared Skill directory could survive the current run and be consumed during later sessions. ### Attack Path 1. A user invokes the Skill for a project containing implementation details or other project-specific context. 2. The Agent reads the project as directed by the survey phase. 3. After implementation, the iteration phase directs the Agent to create or update experience notes under the Skill's `references/` directory. 4. The Agent writes project-derived content outside the declared working-directory write boundary. 5. The stored notes persist after the current task and may be read by subsequent invocations. 6. If insufficiently sanitized, the notes may expose project information across contexts or influence later Agent behavior. This path requires the Agent to possess write access to the installed Skill directory. The reviewed file does not itself establish such acce ...[truncated 730 chars]- Remediation
View remediation