T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:62
- Finding
- Persistent Agent Memory Access for API Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-63, 97-98` **Vulnerability Type**: Access to persistent Agent state for secret retrieval **Risk Level**: Medium ### Evidence ```markdown | 2 | 百度 AK | 百度地图开放平台 AK | MEMORY.md 中已存储 | | 3 | Mapbox AK | Mapbox 访问令牌 | MEMORY.md 中已存储 | ``` ```markdown ## API 密钥 - 百度 AK：MEMORY.md → `百度AK` 字段 - Mapbox AK：MEMORY.md → `Mapbox AK` 字段 ``` ### Technical Analysis The Skill directs the Agent to inspect `MEMORY.md` and extract two reusable API credentials. This expands the Skill's access beyond the mapping operation into persistent Agent state. Reading a general-purpose memory file is broader than the minimum privilege required because the script could instead receive narrowly scoped credentials from a secret manager or protected environment variables. If memory access is not technically restricted to the named fields, loading the file may also expose unrelated persistent data to the Agent context, execution logs, or downstream tooling. ### Attack Path 1. A user invokes the isochrone Skill without explicitly supplying credentials. 2. The Skill instructions direct the Agent to open `MEMORY.md`. 3. The Agent reads the Baidu and Mapbox credentials into its working context. 4. The credentials may subsequently appear in generated commands, process metadata, Agent telemetry, or logs. 5. A party with access to those surfaces can recover and reuse the credentials against the corresponding APIs. ### Impact Assessment Successful exposure provides the ability to use the affected Baidu or Mapbox account within the permissions and quotas assigned to each token. Consequences can include unauthorized API consumption, quota exhaustion, billing impact, and access to any other API functions enabled for those credentials. No evidence indicates that the Skill writes to memory or establishes persistence. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove instructions that require opening or parsing `MEMORY.md`. 2. Retrieve credentials through a scoped secret manager that returns only the specifically requested secret. 3. Alternatively, read the credentials from protected environment variables such as `BAIDU_MAP_AK` and `MAPBOX_ACCESS_TOKEN`. 4. Ensure the Agent never prints, interpolates, or returns secret values in messages. 5. Use restricted API tokens with minimum scopes, origin restrictions, usage limits, and expiration where supported. 6. Rotate credentials that may previously have been exposed through Agent context or logs. ]]>