T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:7
- Finding
- Overbroad Access to Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 7-9 and 18 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Complete Relevant Snippet**: ```markdown 1. Ensure memory file exists for today: - Path: memory/YYYY-MM-DD.md - If missing, create with minimal template ``` ```markdown 3. Optional: promote learnings from recent memory files (if configured) ``` ### Technical Analysis The Skill instructs the Agent to write to persistent memory and optionally process recent memory files. Creating a fixed, current-day health-check file is consistent with the stated operational purpose, but “promote learnings from recent memory files” is broader than a file-presence check. The instructions do not define which memory files may be read, what information qualifies as a learning, where selected content will be written, how sensitive data must be filtered, or what authorization is required. Consequently, a scheduled health-check execution could receive access to conversation-derived information unrelated to cron or file-health monitoring. The issue is a least-privilege violation rather than evidence of deliberate exfiltration. ### Attack Path 1. The Skill runs automatically through an authorized scheduler. 2. The optional memory-promotion feature is enabled. 3. The Agent discovers and reads recent persistent memory files. 4. Those files contain sensitive or untrusted conversation-derived content. 5. Based on the undefined instruction to “promote learnings,” the Agent selects and copies content into another persistent context or state location. 6. The promoted content becomes available to or influences future Agent sessions. This path is conditional because the document states that promotion is optional and must be configured. The audited file does not contain an external transmission mechanism or an explicit instruction to poison memory. ### Impact Asses ...[truncated 612 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the memory-promotion operation from this health-check Skill and implement it as a separate, explicitly authorized workflow. 2. Restrict the health check to an existence or metadata check for the exact current-day path, `memory/YYYY-MM-DD.md`. 3. Prohibit reading the contents of current or historical memory files when only presence must be verified. 4. Define a fixed, non-sensitive template for newly created files and prevent user-controlled content from becoming persistent instructions. 5. If promotion remains necessary, define an allowlist of readable files, a fixed destination, sensitivity filters, retention rules, and explicit user approval requirements. 6. Run the scheduled task with filesystem permissions limited to the minimum required memory path and read-only access to cron metadata. 7. Record which files were accessed or modified without logging their sensitive contents.