T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:17- Finding
Unnecessary Retrieval of Complete User Memory Collection During Health Check
- Content
View full analysis
0 ``` ### Technical Analysis The Skill invokes `get_all main_user` to determine whether the memory store contains any records. This operation retrieves the complete memory list even though the stated health-check objective requires only a count or availability result. Stored agent memories may contain private conversation content, personal information, credentials, or other sensitive context. Returning all records places their contents in the command output and active agent session. This violates least-privilege and data-minimization principles because the requested status check does not require access to individual memory bodies. The hard-coded administrator-specific interpreter and storage paths further indicate that the check may execute in a privileged local environment, although the document itself does not elevate privileges or bypass an access-control mechanism. ### Attack Path 1. A user asks whether mem0 is functioning, triggering the status-check Skill. 2. The agent follows the documented procedure and invokes `mem0_wrapper.py get_all main_user`. 3. The wrapper returns the complete memory list rather than a content-free health result. 4. All returned memory contents enter the process output and may become visible to the invoking agent or active session. 5. Sensitive information present in stored memories can consequently be disclosed beyond what is necessary to answer the status request. The reviewed file does not instruct the agent to transmit this information externally, so the demonstrated exposure is limited to unnecessary local/session-level access. ...[truncated 590 chars]- Remediation
View remediation