T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:205- Finding
Patient Portal Monitoring Exceeds the Declared Network and Authorization Boundary
- Content
View full analysis
User: "Monitor the patient portals for these 3 clinics and alert me if a slot opens before Friday." > Agent: Sets monitoring check cadence. When a slot opens, sends an urgency alert with the time, provider, and a one-tap booking link. ``` ### Technical Analysis The expected behavior requires an agent to repeatedly access external patient portals and detect appointment openings. Patient portals commonly require authenticated access and contain sensitive healthcare information. This instruction conflicts with the package declarations in `skill.json:18-21`: ```json "requires_api": false, "no_code_execution": true, "no_network": true, "no_credentials": true, ``` The project provides no authorization model, credential-handling policy, least-privilege mechanism, session-isolation requirements, polling limits, or approved notification channel. Consequently, an agent attempting to satisfy the documented behavior could request or reuse portal credentials and perform external network actions outside the Skill's declared permissions. ### Attack Path 1. A user or attacker invokes the documented patient-portal monitoring scenario. 2. The agent interprets portal monitoring and alerts as supported Skill behavior. 3. To implement monitoring, the agent requests credentials, reuses an authenticated browser session, or invokes an external ...[truncated 866 chars]- Remediation
View remediation