T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:30
- Finding
- Excessive Autonomous Access and Unapproved Repository Modification## Vulnerability Details **File Location**: `SKILL.md`, lines 30-34 and 57-63 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown **Things to check (rotate through these, 2-4 times per day):** - **Emails** - Any urgent unread messages? - **Calendar** - Upcoming events in next 24-48h? - **Mentions** - Twitter/social notifications? - **Weather** - Relevant if your human might go out? ``` ```markdown **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.) - Update documentation - Commit and push your own changes - **Review and update MEMORY.md** ``` ### Technical Analysis The Skill authorizes an agent to access private communications, calendars, social notifications, project repositories, and persistent memory without requiring explicit approval for each operation. It also permits the agent to modify documentation and commit and push changes autonomously. These instructions violate least-privilege principles by combining broad read access to sensitive resources with write access to local and remote repositories. No resource allowlist, repository scope, branch restriction, confirmation requirement, or validation process is specified. The ability to push changes is particularly sensitive because it allows a heartbeat-triggered workflow to affect shared remote systems. ### Attack Path 1. A heartbeat poll activates the Skill. 2. The agent follows the periodic-check instructions and accesses connected email, calendar, social, memory, or repository resources. 3. Untrusted or misleading content in one of those resources influences the agent's decisions. 4. The agent updates documentation or other project content based on that information. 5. Under the authorization to act “without asking,” the agent commits and pushes the changes. 6. Unreviewed changes consequent ...[truncated 586 chars]
- Remediation
- ## Remediation Suggestions - Make access to email, calendars, social accounts, memory, and repositories individually opt-in. - Define explicit resource, account, repository, and branch allowlists. - Default periodic checks to read-only access and request confirmation before accessing newly connected resources. - Require explicit user approval before modifying project files, committing changes, pushing branches, opening pull requests, or sending external communications. - Prohibit direct pushes to protected or shared branches. - Use a staged workflow in which the agent presents a diff and justification for review before any commit. - Apply least-privilege credentials, short-lived authorization, and comprehensive logging for all accesses and repository mutations. - Treat content retrieved from external communications as untrusted data and prevent it from becoming operational instructions.