T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:26- Finding
Overbroad Access to and Persistent Retention of Session Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:26,SKILL.md:125-129,SKILL.md:163-171,SKILL.md:244-249,templates/evolver_task.md:21-27,templates/evolver_task.md:82-86,README.md:62-69
Vulnerability Type: Overbroad file access and sensitive-context retention
Risk Level: MediumVulnerable Code Snippets
SKILL.md:26:markdown - Skills can read anything; they can only write what the user explicitly approves.SKILL.md:125-129:markdown 1. **Analyze Current State** - Read the existing `SKILL.md` - Check for: completeness, clarity, safety gaps, outdated info - If error reports exist, read `ERRORS.md` or session logs - Identify what's working and what's notSKILL.md:163-171:markdown **Steps:** 1. Read the complete skill directory 2. Check against quality checklist (see below) 3. Output structured report with: - ✅ Strengths - ⚠️ Gaps / Risks - 💡 Improvement suggestions 4. **Do NOT modify anything** — this is read-onlySKILL.md:244-249:markdown ### ALWAYS - Present a clear diff before applying changes - Explain WHY each change is suggested - Backup the old version before overwriting - Respect user rejection — if they say "nein", stop immediately - Log what was changed in `LEARNINGS.md` or session notestemplates/evolver_task.md:21-27:markdown **What happened:** [Describe the event that triggered this improvement opportunity] **Context:** - Session: [session ID or date] - User: [if applicable] - Related logs: [file paths or snippets]templates/evolver_task.md:82-86:markdown ## Documentation - [ ] Session notes updated - [ ] LEARNINGS.md entry added (if broadly applicable) - [ ] CHANGELOG updated (if versioned skill)README.md:62-69:markdown ### Audit a Skill (Read-Only) > "Audit the [skill-name] skill" Skill Evolver will ...[truncated 3518 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace unrestricted language such as “Skills can read anything” and “Read everything” with a least-privilege rule:
- Read only the user-selected Skill directory.
- Read only files required for the requested operation.
- Do not follow paths or references outside that directory without separate approval.
-
Introduce an explicit scope-confirmation step before analysis:
- Display the exact directory and file list to be inspected.
- Require additional informed consent before reading session logs, chat history, agent memory, home-directory files, environment files, or unrelated projects.
- Treat approval to audit a Skill as approval only for that Skill's files.
-
Define default exclusions:
- Secret and credential files, including
.env, private keys, tokens, password stores, cloud credentials, and authentication configuration. - Agent memory and session-history files.
- Version-control metadata and unrelated workspace directories.
- Symlink targets outside the approved directory.
- Secret and credential files, including
-
Add safe log-handling requirements:
- Prefer minimal error excerpts over complete logs.
- Redact access tokens, passwords, cookies, authorization headers, email addresses, user IDs, session IDs, and filesystem paths where they are not essential.
- Never reproduce secrets in reports, diffs, prompts, or task records.
-
Make persistent retention independently opt-in:
- Do not automatically recommend writing session-derived data to
LEARNINGS.mdor session notes. - Preview the exact content and destination before writing.
- Explain that the record may be consumed by future sessions.
- Store generalized lessons rather than raw logs, user identities, or conversation excerpts.
- Do not automatically recommend writing session-derived data to
-
Update the Evolver task template:
- Remove the default
Userfield or mark it as prohibited unless strictly necessary. - Replace raw “file paths or snippets” with sanitized ref ...[truncated 331 chars]
- Remove the default
-