T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:154
- Finding
- Insufficiently Scoped Session-History Access## Vulnerability Details **File Location**: `SKILL.md`, line 154 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Complete Vulnerable Snippet**: ```markdown - Check `sessions_history` for the actual error, don't guess ``` ### Technical Analysis The failure-handling instruction directs the agent to inspect session history but does not impose least-privilege boundaries. It does not limit access to the failed subagent's session identifier, a relevant time range, or structured error and tool-result fields. Session history may contain user prompts, credentials, proprietary source fragments, delegated task data, or unrelated conversation content. Although the audited files contain no instruction to exfiltrate that information, an unrestricted history query can unnecessarily introduce sensitive data into the active agent context. ### Attack Path 1. A delegated subagent fails or appears to fail. 2. The skill activates its failure-handling procedure. 3. Following line 154, the agent invokes `sessions_history`. 4. An insufficiently scoped query retrieves content beyond the failed task, potentially including sensitive or unrelated session data. 5. The retrieved data enters the active context and may influence or be reproduced in generated responses, logs, checkpoints, or files. ### Impact Assessment Exploitation requires the agent to have access to a session-history tool whose authorization model permits broad queries. Under that condition, the instruction may cause read access beyond the failed subagent's data and violate conversation isolation and least-privilege principles. The primary impact is confidentiality loss. Potentially exposed information includes unrelated prompts, source code, credentials, and proprietary task data. The instruction does not itself grant operating-system privileges, modify access controls, establish persistence, execute code, or transmit data e ...[truncated 10 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict history access to the exact failed subagent session ID. 2. Request only structured failure metadata, such as error messages, tool failures, and exit status, rather than complete conversation transcripts. 3. Limit queries to the minimum relevant time range and prohibit access to unrelated sessions. 4. Prefer the failure response already returned by the subagent before querying additional history. 5. Redact credentials, tokens, personal data, and proprietary content before adding diagnostic information to the agent context. 6. Record and audit session-history access, including the requesting task, target session, fields retrieved, and authorization decision. 7. Replace the vulnerable instruction with a least-privilege version, for example: ```markdown - Diagnose failures using the error already returned by the failed subagent. If additional history is essential, read only structured error and tool-result fields from that subagent's exact session ID. Never access unrelated sessions, and redact sensitive values before using or recording the result. ```