T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:47- Finding
Overbroad Collection of Environment and IDE Metadata
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:47-64
Vulnerability Type: Excessive access beyond the minimum required for session handoff
Risk Level: MediumVulnerable Code Snippet
markdown **Supplementary context** (not token-budgeted): project identity, platform status, env var names (status only), capability boundary, knowledge file index, user preferences. #### IDE-Specific Additional Scanning > **Consent required**: Before scanning any of the following, inform the user what files will be accessed and ask for explicit permission. Skip any category the user declines. **For WorkBuddy**, also scan (with user consent): - **Identity files**: `~/.workbuddy/SOUL.md`, `IDENTITY.md`, `USER.md` — persona and preferences - **Memory files**: `.workbuddy/memory/MEMORY.md` + daily logs — project memory - **Installed skills**: `~/.workbuddy/skills/` — list of active skills - **Scheduled tasks**: automation/cron task list and status - **Channel config**: IMA knowledge base IDs, Feishu channel configuration - **MCP connectors**: active MCP connector status **For TRAE SOLO**, also scan (with user consent): - **Rules**: `.trae/rules/` — project-level rules - **Schedule**: TRAE SOLO Schedule task list - **Memory system**: `~/.trae-cn/memory/` — user profile, project memory, recent topics (see `references/memory-guide.md` for path structure)The declared capability is also confirmed at
SKILL.md:145-146:markdown | File read/write | Yes | Reads project files; writes `docs/session-handoff.md` (overwrites if exists). Reads IDE memory/identity files (e.g., `~/.trae-cn/memory/`, `~/.workbuddy/SOUL.md`) **ONLY with explicit user consent** — opt-in, never silent reads | | Environment variables | Yes | Reads env var names (status only, never values) |Technical Analysis
The Skill's primary function is to summarize the current coding session and create a handoff document. The optional workflow extends beyond project and conversation cont ...[truncated 2689 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove environment-variable enumeration from the default handoff workflow. Collect a variable name only when it is directly referenced by the active task or a project configuration file.
- Restrict default scanning to the current conversation and project-relative files needed for the active task.
- Split consent into independent, granular prompts for:
- Identity files
- Project memory
- Cross-project memory
- Installed skills
- Scheduled tasks
- Channel configuration
- MCP connectors
- Environment metadata
- Before each category is accessed, display the exact paths or resources, the fields that will be extracted, and why each item is necessary.
- Default every supplementary category to disabled and provide a fully functional handoff when all optional access is declined.
- Do not place raw identity, memory, connector, channel, task, or environment metadata in the handoff. Include only a narrowly scoped summary explicitly approved by the user.
- Add a final preview and separate confirmation before writing operational metadata to disk.
- Prevent accidental disclosure by recommending or automatically adding generated handoff files to an appropriate ignore mechanism, subject to user approval.
- Refuse to overwrite an existing handoff file without explicit overwrite confirmation or create a versioned backup.
- Add automated validation that rejects absolute personal paths, connector identifiers, channel IDs, internal addresses, environment values, credentials, and unrelated cross-project content.