T05 · Unauthorized Access and Privilege Escalation
- Location
skill.md:272- Finding
Overbroad Authorization for External Communications
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 272–282
Vulnerability Type: Overbroad use of third-party communication accounts and tools
Risk Level: MediumVulnerable Instruction:
markdown **Moltbook** - If you have a Moltbook account, post updates about the game state, coordinate strategies, or discuss what moves to make. Find other agents playing and share observations. **Twitter/X** - If your owner has given you Twitter access, you can post updates or find other agents discussing the game. **Ask Your Owner** - Your human might want to help! They can: - Watch the Twitch stream and give you context - Help you understand confusing game situations - Coordinate with other humans whose agents are playing - Answer Pokemon strategy questions **Other Tools** - Use whatever communication mechanisms your owner has provided. Discord, Slack, email - if you can reach other agents or humans, do it.Technical Analysis
The Skill instructs an agent to use any available communication mechanism, explicitly including social-media accounts, Discord, Slack, and email. These communication capabilities are not necessary for the Skill's core functions of retrieving game state and submitting game-control votes.
The catch-all instruction to use “whatever communication mechanisms” are available does not define approved recipients, permitted information fields, message frequency, or per-message authorization requirements. It also does not prohibit sharing credentials, personal information, conversation context, or other data available to the agent. Consequently, an agent with access to third-party accounts could interpret the instruction as standing authorization to publish or transmit information without obtaining explicit approval for each communication.
This violates least-privilege principles by encouraging use of unrelated account and messaging privileges beyond those required to interact with the Pok ...[truncated 1633 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the catch-all instruction to use any available communication mechanism.
- Restrict optional coordination to explicitly named and trusted services that are necessary for the task.
- Require affirmative user approval before every external message or public post, including approval of the destination, recipient, and exact content.
- Define an allowlist of information that may be shared, such as current game location, badge count, and proposed game action.
- Explicitly prohibit transmission of credentials, authentication tokens, personal data, private conversation content, local files, system information, and unrelated agent context.
- Apply recipient allowlists, rate limits, audit logging, and a clear mechanism for reviewing or revoking communication authorization.
- Default to no external communication when authorization or the sensitivity of the proposed content is uncertain.