T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:113
- Finding
- Excessive Access to Prior Sessions and Sibling Project Source Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23 and 113–120 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Complete Code Snippet ```markdown - `session_search(query, project)` — find how similar research was done before ``` ```markdown 3. **Search knowledge base and past work:** - If MCP `kb_search` available: `kb_search(query="<idea keywords>", n_results=5)` - If MCP `session_search` available: `session_search(query="<idea keywords>")` — check if this idea was researched before - Otherwise: Grep for keywords in `.md` files - Check if `research.md` or `prd.md` already exist for this idea. 4. **Check existing portfolio** (if MCP codegraph tools available): - `codegraph_explain(project="<similar project>")` — architecture overview of related projects in the portfolio - `project_code_search(query="<relevant pattern>", project="<sibling>")` — find reusable code, patterns, infrastructure - `codegraph_query("MATCH (p:Project)-[:DEPENDS_ON]->(pkg:Package) WHERE pkg.name CONTAINS '<relevant tech>' RETURN p.name, pkg.name")` — find projects using similar tech ``` ### Technical Analysis The skill directs the agent to search historical sessions and inspect architecture, dependencies, and source patterns from sibling projects. These resources may contain confidential user context, proprietary source code, credentials inadvertently recorded in session history, or information belonging to projects outside the current research task. Although the MCP tools are included in the skill's declared tool list, the workflow does not require explicit user authorization before crossing current-project boundaries. Market research can be completed without accessing unrelated session history or sibling-project source data. This violates least-privilege principles and creates a risk of unintended cross-project disclosure. The issue does not prove that the skill obtains operating-sys ...[truncated 1785 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable `session_search`, `codegraph_explain`, `project_code_search`, and `codegraph_query` by default for ordinary market-research tasks. 2. Require explicit, informed user consent before searching prior sessions or any project other than the current one. 3. Restrict every query to an explicit allowlist of project and session identifiers authorized for the active user. 4. Enforce authorization in the MCP backend rather than relying solely on skill instructions. 5. Return only minimal metadata by default; source text and full session content should require separate approval. 6. Apply output filtering so retrieved secrets, credentials, personal information, and proprietary source fragments cannot be copied into `research.md`. 7. Record an audit log identifying which sessions and projects were queried. 8. Clearly label any output derived from prior sessions or sibling projects and request confirmation before writing it to disk. 9. Prefer current-project files and public web sources unless cross-project reuse is explicitly requested. ]]>