T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:27
- Finding
- Potential Unauthorized Disclosure of Local Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 27–88 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```bash SCIENCECLAW_DIR="${SCIENCECLAW_DIR:-$HOME/scienceclaw}" AGENT=$(python3 -c "import json,pathlib; p=pathlib.Path.home()/'.scienceclaw'/'agent_profile.json'; print(json.loads(p.read_text()).get('name','ScienceAgent'))" 2>/dev/null || echo "ScienceAgent") cd "$SCIENCECLAW_DIR" python3 memory_cli stats --agent "$AGENT" ``` ```bash python3 memory_cli journal --agent "$AGENT" --recent 10 ``` ```bash python3 memory_cli investigations --agent "$AGENT" --active ``` ```bash python3 memory_cli journal --agent "$AGENT" --topics ``` ```bash python3 memory_cli graph --agent "$AGENT" --search "CRISPR" ``` ```bash AGENT=$(python3 -c " import json, pathlib p = pathlib.Path.home() / '.scienceclaw' / 'agent_profile.json' print(json.loads(p.read_text()).get('name', 'ScienceAgent')) " 2>/dev/null || echo "ScienceAgent") ``` ```markdown If the workspace memory (`memory.md`) contains a preferred agent name, use that as the default `--agent` value. ``` ### Technical Analysis The skill instructs the agent to read the local ScienceClaw profile, consult workspace memory, and invoke broad memory queries covering journal entries, investigated topics, active investigations, and knowledge-graph content. These operations are consistent with the skill's declared status-inspection purpose, but the instructions do not require verification that the requester is authorized to access the selected agent's stored information. The default response also includes recent topics and active investigations. These records may contain private research interests, activity history, agent identity information, or other sensitive state. The skill does not prescribe output redaction, data classification, least-disclosure defaults, or explicit c ...[truncated 1516 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before reading detailed journals, active investigations, knowledge-graph records, or `memory.md`. 2. Verify that the requester is authorized to access the selected agent's records before invoking detailed memory subcommands. 3. Make aggregate, non-sensitive statistics the default output and require an explicit request for record-level details. 4. Avoid reading `memory.md` merely to resolve an agent name unless the user explicitly authorizes workspace-memory access. 5. Redact secrets, personal data, unpublished research details, filesystem paths, and other sensitive content before presenting results. 6. Limit recent-entry output to the minimum necessary and provide configurable disclosure levels. 7. Clearly inform the user which local data sources will be accessed before running the commands. 8. Add error handling that does not expose raw record contents, sensitive paths, or profile data. 9. Where supported, enforce access control within `memory_cli` rather than relying solely on conversational instructions.