T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:130- Finding
Overbroad Access to Persistent Agent Memory and User Profile Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:130-136andSKILL.md:171-179
Vulnerability Type: Excessive read access to sensitive persistent context
Risk Level: MediumVulnerable Instructions
markdown ### 4. Memory/Context Files (if using ai-persona-os) **Locations:** - `MEMORY.md` — Permanent facts - `memory/[today].md` — Session notes - `USER.md` — User preferencesThe data-gathering procedure reinforces this access:
markdown ### Step 1: Gather Data Sources Check for these files in order: 1. todo.md (to-do list from ai-meeting-notes) 2. meeting-notes/ folder (recent meeting notes) 3. MEMORY.md (if using ai-persona-os) 4. memory/[today].md (session notes) 5. Calendar integration (if available)Technical Analysis
The Skill directs the agent to read persistent memory, daily session notes, and user-profile data while generating a daily briefing. These files can contain sensitive personal facts or conversation context unrelated to tasks, meetings, or calendar planning.
The instructions do not:
- Require explicit user consent before accessing persistent memory.
- Restrict extraction to task-related fields.
- Define exclusions for credentials, financial information, health information, or other sensitive data.
- Require redaction before incorporating memory content into the briefing.
- Limit access to particular user-approved files or sections.
Consequently, the agent receives broader read scope than is strictly necessary for producing a task and calendar summary. This violates least-privilege principles and creates a risk that unrelated private information will be surfaced in the generated response.
This finding does not establish external exfiltration, code execution, write access, or operating-system privilege escalation. The exposed capability is read access to workspace-level persistent context and subsequent disclosure through agent output.
Attack Path
- Sensitive or unrelated information is present ...[truncated 1452 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable persistent-memory access by default and make it an explicit opt-in feature.
- Before reading memory or profile files, ask the user for informed consent and identify the files that will be accessed.
- Restrict briefing sources to
todo.md, the approved recent-meeting directory, and calendar data unless the user specifically enables additional sources. - If memory access is enabled, use a structured allowlist of briefing-safe fields rather than scanning entire files.
- Exclude credentials, authentication tokens, financial data, health information, private communications, and unrelated personal facts.
- Apply redaction and sensitivity filtering before incorporating extracted content into the briefing.
- Limit meeting-note scanning to the documented three-to-seven-day period and to files explicitly designated as meeting notes.
- Clearly label the source of each surfaced context item so users can detect unexpected data access.
- Add an instruction that content read from workspace files is untrusted data and must not be treated as executable agent instructions.
- Provide a preference such as
memory_context: falseand require the user to change it deliberately before persistent memory is accessed.