T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:457
- Finding
- Unscoped Cross-Session Memory Access Without Explicit User Consent## Vulnerability Details **File Location**: `SKILL.md`, lines 457-470 **Vulnerability Type**: Cross-session memory access exceeding least privilege **Risk Level**: Medium **Classification**: T05: Unauthorized Access and Privilege Escalation ### Vulnerable Code Snippet ```markdown ### Memory Search Integration Before starting research, check for relevant prior knowledge: \`\`\` → memory_search(query="previous research on [topic]") → memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found] \`\`\` Use prior findings to: - Avoid duplicate research - Build on previous conclusions - Identify how understanding has evolved - Note persistent gaps from prior research ``` The memory tools are also declared in `SKILL.md`, line 30: ```markdown | `memory_search` / `memory_get` | Cross-reference prior knowledge | Check MEMORY.md for related context | ``` ### Technical Analysis The Skill instructs the agent to search persistent memory and retrieve matching historical memory files before beginning research. This behavior is not limited to records created for the current task, conversation, or user, and the Skill does not require separate user approval before accessing those records. Persistent agent memory may contain confidential topics, personal information, organizational context, or conclusions from unrelated sessions. A broad query such as `previous research on [topic]` can locate records that happen to share keywords with the current request. The subsequent `memory_get` call reads the matching file in full or in part, allowing unrelated historical context to affect the current report. This exceeds the minimum privileges necessary for the declared web-research functionality. Web search and source retrieval can operate without reading cross-session memory. The existing planning checkpoint does not adequately mitigate the issue because the Skill does not require the proposed plan to disclose the exact memory query, matching paths, intended fields, or pri ...[truncated 1773 chars]
- Remediation
- ## Remediation Suggestions 1. Remove mandatory memory access from the default research workflow. The Skill should remain functional using only the current conversation, `web_search`, and `web_fetch`. 2. Make persistent-memory access explicitly opt-in. Before calling either memory tool, explain why access is useful, what query will be executed, and what categories of historical data may be returned. 3. Require a dedicated approval checkpoint for memory retrieval rather than treating general approval of the research plan as consent. 4. Restrict searches to a task-scoped or user-scoped namespace enforced by the host platform. Do not rely only on topic keywords as an access-control mechanism. 5. Display matching memory paths and minimal metadata first. Require confirmation before calling `memory_get` on any record. 6. Retrieve only the minimum necessary excerpt rather than an entire dated memory file. 7. Add an explicit prohibition against placing memory-derived confidential information, identifiers, proprietary text, or personal data into `web_search` or `web_fetch` requests without separate approval. 8. Label memory-derived claims in the report and allow the user to exclude them. 9. If reliable user or task isolation cannot be guaranteed, disable `memory_search` and `memory_get` for this Skill. A safer replacement would be: ```markdown Persistent-memory access is disabled by default. If prior research may be helpful, ask the user for explicit permission and disclose the exact scoped query. Search only memory belonging to the current user and project. Show matching record metadata before retrieval, retrieve only approved excerpts, and never include memory-derived sensitive data in network requests without separate consent. ```