T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:10
- Finding
- Excessive Cross-Session and Cross-Project Information Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10 and 26–27, with invocation instructions at lines 79–92 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Complete Code Snippet ```markdown allowed-tools: Read, Grep, Bash, Glob, Write, Edit, AskUserQuestion, mcp__solograph__session_search, mcp__solograph__project_code_search, mcp__solograph__codegraph_query, mcp__solograph__codegraph_explain, mcp__solograph__kb_search, mcp__solograph__web_search, mcp__context7__resolve-library-id, mcp__context7__query-docs ``` ```markdown - `session_search(query)` — find similar past work in Claude Code chat history - `project_code_search(query, project)` — find reusable code across projects ``` ```markdown c. **Precedent retrieval** (context graph pattern — search past solutions BEFORE planning): - Search past sessions (if MCP available): ``` session_search(query="{task description keywords}") ``` Look for: how similar tasks were solved, what went wrong, what patterns worked. - Search KB for relevant methodology: ``` kb_search(query="{task type}: {keywords}") ``` Check for: harness patterns, architectural constraints, quality scores. d. **Search code across projects** (if MCP available): ``` project_code_search(query="{relevant pattern}") ``` ``` ### Technical Analysis The Skill directs the Agent to search historical Claude Code conversations and source code across other projects while performing a planning task for the current repository. Access to unrelated sessions and projects is not required for the Skill's core purpose of inspecting the current codebase and producing local specification and implementation-plan files. The workflow does not require explicit user consent before accessing these broader information domains. It also lacks project allowlisting, session scoping, data classification, secret filtering, and rules prohibiting the r ...[truncated 2290 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `mcp__solograph__session_search` and `mcp__solograph__project_code_search` from the default `allowed-tools` list unless they are essential to an explicitly requested operation. 2. Restrict routine research to files located in the current repository. 3. Require explicit, informed user approval before searching historical sessions or unrelated projects. 4. Require callers to identify an allowlisted project or session scope rather than permitting unrestricted keyword searches. 5. Apply access-control checks in the MCP services so results are limited to projects and sessions the current user is authorized to inspect. 6. Scan retrieved results for credentials, tokens, personal information, and other sensitive values before exposing them to the Agent. 7. Add a mandatory instruction prohibiting verbatim reproduction of unrelated conversation content or proprietary source code in `spec.md`, `plan.md`, and final responses. 8. Prefer summaries containing only architectural patterns when cross-project research is approved; do not copy implementation details. 9. Record an audit trail identifying the approved scope, queries performed, result sources, and generated files receiving derived information. 10. If broad retrieval remains available, use separate opt-in tools or a dedicated Skill so the elevated information-access behavior is visible to the user. ]]>