T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- usage-guide.md:120
- Finding
- Uncontrolled Collection and Cross-Agent Sharing of User Interaction Data## Vulnerability Details **File Locations**: - `SKILL.md:126` - `SKILL.md:175` - `memory-trigger-management.md:272-275` - `trigger-logic.md:11` - `usage-guide.md:69-73` - `usage-guide.md:120-124` **Vulnerability Type**: Excessive access to historical user data and insufficiently controlled cross-agent sharing **Risk Level**: Medium ### Vulnerable Snippets `SKILL.md:126`: ```markdown - **Weekly**: Check task history, identify high-complexity tasks without workflows ``` `SKILL.md:175`: ```text Check Task History (is it a repetitive type?) ``` `memory-trigger-management.md:272-275`: ```markdown ### With Agent Systems - **Task Execution**: Integrate with agent task execution systems - **Knowledge Sharing**: Share workflows across agent teams - **Collaboration**: Enable collaborative workflow creation ``` `trigger-logic.md:11`: ```text Check Task History (is it a repetitive type?) ``` `usage-guide.md:69-73`: ```markdown ### Medium-term Improvements (1 month) 1. **Machine Learning Integration**: Use ML to improve pattern recognition 2. **Cross-Agent Learning**: Share learning across different agents 3. **Automated Workflow Generation**: Automatically generate workflow drafts ``` `usage-guide.md:120-124`: ```markdown ### Data Collection Phase - Collect task execution data - Record user interactions - Track workflow usage - Gather user feedback ``` ### Technical Analysis The Skill instructs an agent to inspect task history, record user interactions and task-execution data, create persistent workflow documentation, and share workflows or learned information across agents. These operations require access beyond the immediate task context and may cross user, session, or agent isolation boundaries. The documentation does not define: - Explicit user consent before historical data is inspected or recorded. - A least-privilege scope for history access. - Separati ...[truncated 2873 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed opt-in before reading task history, recording interactions, or enabling cross-agent sharing. 2. Limit history access to the current user, workspace, and minimum time range required for repetition detection. 3. Use non-sensitive metadata or irreversible task fingerprints for similarity detection instead of retaining complete conversation content. 4. Add automatic redaction for credentials, tokens, personal data, internal addresses, configuration secrets, and other sensitive values before workflow creation. 5. Apply per-user, per-workspace, and per-agent access controls to all workflow documents and monitoring records. 6. Disable cross-agent sharing by default. Require a separate authorization decision for every destination agent or explicitly approved trust group. 7. Define retention periods, deletion procedures, and user controls for inspecting, correcting, exporting, and deleting recorded information. 8. Encrypt persisted workflow and monitoring data at rest and protect it in transit where sharing is explicitly authorized. 9. Record auditable events for history access, workflow creation, sensitive-data redaction, and cross-agent sharing. 10. Document that workflow generation must exclude raw secrets even when users explicitly request task documentation. 11. Add negative tests confirming that one agent, user, or workspace cannot retrieve workflows or interaction records belonging to another authorization scope.