T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:228
- Finding
- Autonomous Access to Email Verification Codes Exceeds Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, lines 228–249 **Vulnerability Type**: Unauthorized access to a sensitive communication channel **Risk Level**: Medium **Complete vulnerable snippet**: ```markdown **Step 2 — Verify via email:** A 6-digit verification code is sent to the provided email. The user (or agent, if it has email access) must retrieve this code. ``` POST /api/product-requests/verify Content-Type: application/json { "requestId": "abc123", "verificationCode": "482917" } ``` **Response:** ```json { "success": true, "message": "Request verified successfully" } ``` **Important notes:** - The verification code expires after 24 hours - The verify endpoint is rate-limited to 5 attempts per IP - If you have email access, you can complete this flow autonomously - If not, ask the user: "I've submitted your request. Please check your email for a 6-digit verification code from Criticaster." ``` ### Technical Analysis The skill explicitly authorizes an agent with mailbox access to retrieve a one-time verification code and use it to complete an externally verified action autonomously. Access to a user's email is a sensitive privilege that is not required for the skill's primary purpose of searching, comparing, and recommending products. This guidance violates the principle of least privilege and removes a meaningful user-confirmation boundary. A verification code ordinarily demonstrates that the mailbox owner approves or controls the transaction. Allowing the agent that initiated the operation to read and submit the code collapses initiation and authorization into one actor. The documented workflow applies directly to product-request verification and is also referenced as the model for upvote verification. The issue does not establish that the skill can acquire mailbox permissions by itself; exploitation requires the host agent to have preexisting email access. Nevertheless, o ...[truncated 1608 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction permitting autonomous mailbox access and code retrieval. 2. Require the user to retrieve and manually provide the verification code for every product request or upvote. 3. Obtain explicit, transaction-specific user consent before submitting the user's email address or initiating any state-changing API request. 4. Clearly present the intended request text, request type, recipient service, and privacy implications before submission. 5. Treat verification codes as sensitive authentication data and prohibit storing them in logs, memory, or persistent state. 6. If mailbox integration is unavoidable, require narrowly scoped access, explicit approval immediately before reading the relevant message, strict sender and recipient matching, minimal message retrieval, and prevention of access to unrelated emails. 7. Keep product search and recommendation functions available without requiring email access or state-changing operations.