T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- plan-research-search.md:5
- Finding
- Mandatory cross-project corpus search exceeds the task's repository boundary## Vulnerability Details **File Location**: `plan-research-search.md`, lines 5–12; reinforced by lines 44–56 **Vulnerability Type**: Excessive access to peer-project and shared knowledge documents **Risk Level**: Medium ### Vulnerable Instructions ```markdown When the user mentions `#N` or a domain keyword, the first action is a **Mandatory RAG & Corpus Pre-Lookup (HARD STOP)**: 1. **RAG Semantic Search**: Run vector memory / RAG semantic search (e.g. `python3 scripts/qdrant-search.py "<keywords>"`) to look up past research, plans, and session decisions. 2. **Workspace & Corpus Glob Search**: Search across active and peer documentation directories (`.agents/docs/generated/*<keyword>*.md`, `daegunsoftDev/.agents/docs/generated/*<keyword>*.md`, `llm-wiki/outputs/*<keyword>*.md`) using keyword matching regardless of prefix (`find -iname '*<keyword>*.md'`). 3. **Plan Glob before Query Commands**: Plan/Research search comes before query commands such as `gh issue view`, `gh pr view`, and `git log`. 4. **Mandatory Read & Prior Knowledge Section**: When relevant artifacts are found, **Read the body and map it to the work scope** → cite and synthesize them under a `## Prior Knowledge & Context` section in the new research document. Asserting "no prior plan/research exists" without physically executing RAG semantic search and LLM Wiki corpus search is STRICTLY FORBIDDEN. ``` The later rules broaden this behavior further: ```markdown | 8 | Skip Read for any Glob/find result by guessing "probably not directly related to this task" | **Mandatory Read for every found file**. No guessing. Determine irrelevance only after reading the body | | 9 | Search only one keyword from the task description ... | **Exhaustively extract** all domain keywords ... and run a separate Glob for each. | | 10 | Conclude "cannot access this ..." before searching fix_plan.md / docs for the domain keyword | Domain keywords apply even without a `#N` or GitHub context — a business/administrative ...[truncated 3937 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict pre-searches to the user-selected repository and its explicitly associated artifact directory by default. 2. Resolve search roots from trusted workspace configuration rather than embedding peer-project paths in generic Skill instructions. 3. Require explicit user approval before searching any peer repository, organization-wide wiki, shared memory collection, or cross-project artifact directory. 4. Enforce canonical-path validation against a directory allowlist before reading search results. 5. Use a two-stage process: - Search trusted metadata, filenames, and approved indexes first. - Read document bodies only after confirming that the result belongs to the current project and is relevant. 6. Do not require every search result to be read. Permit rejection based on trusted repository identity, tenant metadata, classification labels, and artifact provenance. 7. Tag retrieved content with project and confidentiality metadata, and block cross-project synthesis unless an explicit sharing policy permits it. 8. Before RAG dispatch or GitHub publication, scan generated artifacts for content sourced from other repositories and require user confirmation for any cross-project material. 9. Treat issue titles, descriptions, comments, and other externally supplied task metadata as untrusted search inputs. Normalize them and constrain keyword expansion to the current project's approved corpus. 10. Record an audit trail containing the authorized search roots, matched artifacts, documents actually read, and any content included in externally published outputs.