T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:110
- Finding
- Unrestricted Access to Secret-Bearing Environment Files and Git History## Vulnerability Details **File Location**: `SKILL.md`, lines 110–177 **Vulnerability Type**: Insufficient least-privilege and secret-handling controls **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### 5. Validate Current .env If `.env` exists, compare against discovered variables: ```markdown ## .env Validation Report ### ❌ Missing (required by code but not in .env) - `STRIPE_SECRET_KEY` — referenced in src/billing.ts:14 - `SMTP_PASSWORD` — referenced in src/email.ts:8 ### ⚠️ Unused (in .env but not referenced in code) - `OLD_API_ENDPOINT` — may be safe to remove ### ✅ Present and referenced - `DATABASE_URL` ✓ - `PORT` ✓ - `NODE_ENV` ✓ ``` ``` ```markdown Also check git history for accidentally committed `.env` files: ```bash git log --all --diff-filter=A -- .env .env.local .env.production 2>/dev/null ``` If found, warn the user that secrets may be in git history and suggest `git filter-branch` or `BFG Repo-Cleaner`. ``` ```markdown - **Multiple .env files**: `.env.development`, `.env.production`, `.env.test` — validate all - **No .env exists**: Generate both `.env.example` and a starter `.env` ``` ```markdown | Permission denied on .env | Check file permissions; may need elevated access | ``` ### Technical Analysis The Skill instructs the Agent to inspect `.env` files and search repository history for environment files. These resources commonly contain passwords, API keys, access tokens, database connection strings, and other credentials. The instructions do not explicitly require the Agent to: - Read only environment-variable names rather than values. - Redact values before including results in tool output, context, logs, or reports. - Obtain confirmation before examining additional environment variants or Git history. - Remain within the repository and its existing permission boundary. - Refuse to elevate privileges when an environment file can ...[truncated 1988 chars]
- Remediation
- ## Remediation Suggestions 1. Require metadata-only parsing of environment files. Extract variable names and syntax status without returning or retaining values. 2. Mandate replacement of every parsed value with a fixed marker such as `[REDACTED]` before producing output or adding data to Agent context. 3. Explicitly prohibit printing raw `.env` lines, Git diffs, historical blobs, connection strings, tokens, passwords, or private keys. 4. Require explicit user confirmation before reading each environment file beyond the default `.env`, and separately before inspecting Git history. 5. Restrict all scanning to the repository root after resolving canonical paths. Reject symlinks or paths that resolve outside that boundary. 6. Remove the recommendation to use elevated access. If a file cannot be read with existing permissions, report it as inaccessible and allow the user to resolve permissions manually. 7. For Git-history checks, initially report only file paths and commit identifiers. Do not retrieve historical file contents unless the user expressly authorizes a redacted local scan. 8. Generate `.env.example` from discovered variable names and safe placeholders only. Never copy values from an existing `.env`. 9. Before creating a starter `.env`, request user approval, apply restrictive filesystem permissions where supported, and ensure the file is ignored by Git. 10. Add explicit safeguards stating that sensitive values must never be included in reports, command transcripts, telemetry, persistent memory, or external requests.