T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:25
- Finding
- Overbroad Access to User Communications, Profiles, and Core Memory## Vulnerability Details **File Location**: `SKILL.md:25`, `SKILL.md:43`, `SKILL.md:181`, and `SKILL.md:274` **Vulnerability Type**: Excessive access to personal and third-party information **Risk Level**: Medium ### Vulnerable Instructions `SKILL.md:25`: ```markdown This skill depends on `sage-cognitive` for personality profile, audience context, and memory. Load the user's profile before generating any output. ``` `SKILL.md:43`: ```markdown Before writing anything, build a style fingerprint from the user's actual messages, emails, and documents. Look for these dimensions: ``` `SKILL.md:181`: ```markdown 1. Load team member profile from sage-cognitive (if available) ``` `SKILL.md:274`: ```markdown 1. Load the user's `core` memory from sage-cognitive ``` ### Technical Analysis The Skill directs the agent to load the user's profile and core memory before generating output and to analyze the user's messages, emails, and documents. It can also retrieve profiles belonging to team members. These instructions do not establish: - A requirement for explicit user consent before retrieval. - A task-specific allowlist of permitted records or fields. - A relevance boundary limiting access to the current writing request. - A distinction between the user's information and third-party information. - Rules preventing retrieved sensitive information from appearing in generated text. A voice-writing assistant can perform its declared function using writing samples explicitly supplied or selected by the user. Automatically loading broad profile and memory data for every output therefore exceeds the minimum privileges needed for many routine drafting tasks. This finding depends on the host granting the Skill access through `sage-cognitive`. The Markdown file contains no direct implementation for bypassing access controls, but its instructions encourage unnecessarily broad use of whatever memory privileges the i ...[truncated 1532 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory profile loading with explicit, task-scoped retrieval. 2. Ask for informed user consent before accessing messages, emails, documents, or third-party profiles. 3. Prefer writing samples directly supplied or explicitly selected by the user. 4. Retrieve only the minimum fields required for the current audience and writing mode. 5. Do not load team-member profiles unless the user authorizes that specific retrieval and the profile is necessary for the task. 6. Add a policy prohibiting unrelated retrieved information from being incorporated into output. 7. Treat retrieved documents and memory records as untrusted data, not agent instructions. 8. Enforce access control in `sage-cognitive` rather than relying only on natural-language instructions. 9. Log memory reads and provide users with a way to inspect which records were accessed. 10. Use task-scoped memory views instead of loading the complete `core` memory.