T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/ari.py:594
- Finding
- Mandatory Retrieval of Account-Wide Metadata and Unrelated Alerts Exceeds the Skill's Minimum Required Scope## Vulnerability Details **File Location**: `SKILL.md:21-22`, `SKILL.md:96-99`, `scripts/ari.py:594-611`, and `scripts/ari.py:1499-1505` **Vulnerability Type**: Excessive authenticated data access and violation of least privilege **Risk Level**: Medium ### Code Snippet ```python def cmd_check(args): release = fetch_release() me = request_json("GET", "/api/v1/user/me") if not ok(me): emit(me, args.compact) return balance = request_json("GET", "/api/v1/credits/balance") if not ok(balance): emit(balance, args.compact) return auto = request_json("GET", "/api/v1/user/autoconfirm") emit({"success": True, "data": { "skillVersion": VERSION, "release": release, "user": data_of(me), "balance": data_of(balance), "autoConfirm": data_of(auto) if ok(auto) else None, }, "links": links()}, args.compact) ``` ```python def cmd_alerts(args): if args.mark_read: emit(request_json("POST", "/api/v1/alerts/read"), args.compact) return emit(request_json("GET", "/api/v1/alerts", params={"limit": args.limit}), args.compact) ``` The Skill instructions require `check` at the start of every session and direct the Agent to retrieve alerts after that check. These actions occur even though the declared specialized purpose is to provide Amazon title-optimization recommendations from product details and review evidence. ### Technical Analysis All calls are authenticated using the user's ARI Bearer API key. The `check` command retrieves the user profile, credit balance, and account-level automatic-confirmation policy. The additional `alerts` command retrieves account-wide review alerts that may concern products unrelated to the title-optimization request. Authentication is not bypassed, and the code does not gain operating-system privileges. The security concern is that the Skill directs the Agen ...[truncated 2023 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to retrieve alerts automatically at the beginning of every session. 2. Invoke `alerts` only when the user explicitly requests alerts or when alerts are directly relevant to the requested workflow. 3. Replace the broad `check` response with a minimal endpoint or response projection that returns only: - Whether authentication is valid - Whether the requested operation is available - The usable balance needed for an imminent paid operation 4. Do not retrieve or return the complete user profile for ordinary title-analysis requests. 5. Query the automatic-confirmation policy only when the Agent is about to perform an operation that could consume credits. 6. Scope product and alert queries to the user-requested ASIN whenever the API supports such filtering. 7. Document each category of account data retrieved and explain when it is necessary. 8. Add tests confirming that a read-only title request does not enumerate unrelated account alerts or retrieve unnecessary profile fields.