T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- playbooks/convert-lead-to-job.md:342
- Finding
- Undeclared Cross-Workspace Writes and Persistent Data Propagation## Vulnerability Details **File Location**: `playbooks/convert-lead-to-job.md`, lines 342–411 **Vulnerability Type**: Least-privilege violation through cross-workspace configuration changes and external data propagation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Step 6: Trigger Company Project Registry Checklist **Action:** Run {{company_name}}'s internal project setup workflow from `project-registry.json` **⚠️ This is company-specific, not Buildertrend. This runs AFTER BT job creation.** **Message to the user:** ``` 🏗️ BT job is live! Now running company project setup: ☐ Google Drive — create project folder + subfolders ☐ Apple Reminders — create company project list ☐ Update project-registry.json ☐ Update agent TOOLS.md — Active Projects table ☐ Update agent MEMORY.md — Active Projects ☐ Update receipt agent config — receipt routing ☐ Update receipt agent known-projects.json ☐ Update bookkeeper agent QBO config ☐ Update procurement agent known-projects.json ☐ Notify all agents of new project Proceed with full setup? ``` ### Registry Setup Execution Follow **every step** in `SKILLS/project-registry.json` → `update_checklist`: 1. **Google Drive** — create folder under `Projects/` with standard subfolders: - Invoices - Expenses / Receipts - Pending Review / Receipts - Matched - Estimating - Procurement - Orders - Other Documents 2. **project-registry.json** — add new project entry with: - Title, code, BT job ID, Drive folder ID, contract type, PMs, dates 3. **agent TOOLS.md** — add to Active Projects table 4. **agent MEMORY.md** — add to Active Projects section 5. **receipt agent rcpt/config.json** — add receipt routing for project code 6. **receipt agent rcpt/known-projects.json** — add project matching patterns 7. **bookkeeper agent quickBooks transactions/config.json** — add QBO mapping 8. **procurement agent purchasing-manager/known-projects.json** — add procurement matching 9. **{{bookkeeper_workspac ...[truncated 4201 chars]
- Remediation
- ## Remediation Suggestions 1. **Separate the cross-system workflow** - Move Google Drive, Reminders, filesystem, and multi-agent configuration operations into a separate skill. - Declare every required capability explicitly in that skill’s manifest. 2. **Remove unaudited instruction dependencies** - Bundle and review `project-registry.json` with the skill. - Pin the checklist to a validated schema or cryptographic digest. - Reject unknown operations and destinations rather than executing every listed step. 3. **Enforce destination allowlists** - Resolve and canonicalize every path before writing. - Restrict writes to explicitly approved workspace roots. - Reject path traversal, symbolic-link escapes, absolute paths outside approved roots, and unresolved placeholders. 4. **Use granular authorization** - Request separate confirmation for local memory changes, each agent workspace, Google Drive, Apple Reminders, and cross-agent notifications. - Display exact destination paths, records, recipients, and fields before execution. - Do not treat one “Run Full Setup” action as authorization for all systems. 5. **Minimize propagated data** - Share only fields required by each destination. - Avoid storing customer contact details, financial mappings, or folder identifiers in general-purpose long-term memory unless necessary. - Apply documented retention and deletion policies. 6. **Protect configuration integrity** - Validate modifications against strict schemas. - Use atomic writes and retain backups. - Show a diff before committing changes. - Provide transaction-style rollback if any step fails. 7. **Align documentation and metadata** - Update `skill.json` and the security documentation to disclose all optional capabilities and external destinations. - Remove the claim that operation is browser-only when optional workflows write to files, cloud storage, reminders, and other agents.