T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:35
- Finding
- Mandatory Account-Wide Data Retrieval Exceeds Task-Specific Least Privilege## Vulnerability Details **File Location**: `SKILL.md:35, 91-95`; implementation in `scripts/ari.py:584-601, 1494-1500` **Vulnerability Type**: Excessive account-wide API access **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:35`: ```markdown - CLI：本 Skill 目录下的 `scripts/ari.py`。在 Skill 根目录执行，例如 `python scripts/ari.py check`；每次会话先跑一次 `check`。 ``` `SKILL.md:91-95`: ```markdown 8. 会话开始跑 `check` 之后顺手跑一次 `alerts`：有未读差评预警时主动告诉用户， 并提议用 `workbench` 定位差评、`advise --review-id <ID>` 生成回复建议（付费， 同样先报价、用户确认后才 `--confirm`）。 ``` `scripts/ari.py:584-601`: ```python def cmd_check(args): # 先取公开发布信息：Key 无效时也能顺带告诉用户「你的版本旧了、去哪儿更新」。 release = fetch_release() me = request_json("GET", "/api/v1/user/me") if not ok(me): emit(me, args.compact) return balance = request_json("GET", "/api/v1/credits/balance") if not ok(balance): emit(balance, args.compact) return # 免确认策略（1.4.5）：告诉 agent 当前用户是「小额直接生成」还是「每次先问」 auto = request_json("GET", "/api/v1/user/autoconfirm") emit({"success": True, "data": { "skillVersion": VERSION, "release": release, "user": data_of(me), "balance": data_of(balance), "autoConfirm": data_of(auto) if ok(auto) else None, }, "links": links()}, args.compact) ``` `scripts/ari.py:1494-1500`: ```python def cmd_alerts(args): """情感预警（免费）。差评突增等预警由服务端离线生成，这里只读。""" if args.mark_read: emit(request_json("POST", "/api/v1/alerts/read"), args.compact) return emit(request_json("GET", "/api/v1/alerts", params={"limit": args.limit}), args.compact) ``` ### Technical Analysis The Skill requires the Agent to run `check` at the beginning of every session and then retrieve alerts. The `check` operation obtains account identity data, credit balances, and the account’s automatic-confirmation policy. The subsequent `alerts` request retrieves account-wide review alerts. These requests are not inherently malicious and use t ...[truncated 2255 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional requirement to run `check` and `alerts` at the beginning of every session. 2. Run `check` only when authentication validation, balance information, or billing authorization is necessary for the requested operation. 3. Retrieve alerts only when the user explicitly requests alerts or opts into proactive account monitoring. 4. Add an ASIN filter to alert retrieval and default it to the ASIN in the current request. 5. Request explicit consent before loading account-wide alerts or unrelated product information into Agent context. 6. Split `check` into narrowly scoped operations, such as authentication status, balance, and automatic-confirmation policy, so the Agent retrieves only what the current task requires. 7. Minimize returned profile fields and redact unnecessary identifiers before emitting API responses. 8. Document the exact account information retrieved and its purpose during authorization. 9. Avoid additional authenticated calls when cached session-level authentication status is sufficient and safe to reuse.