T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/session-recall.py:252- Finding
Cross-Agent Session Transcripts Are Accessible Without Authorization
- Content
View full analysis
Vulnerability Details
File Location:
scripts/session-recall.py:93-126,scripts/session-recall.py:209-216, andscripts/session-recall.py:252-260
Vulnerability Type: Missing authorization and violation of least privilege
Risk Level: HighVulnerable Code
python def discover_agents() -> list[str]: """List all agent directories that have a sessions/ subdirectory.""" if not SESSIONS_BASE.is_dir(): return [] return sorted( d.name for d in SESSIONS_BASE.iterdir() if d.is_dir() and (d / "sessions").is_dir() ) def get_session_files( agent: str, start_ts: float | None = None, end_ts: float | None = None, ) -> list[Path]: """Get session JSONL files for an agent, sorted by mtime descending. Filters by file mtime: - start_ts: only files modified at or after this time - end_ts: only files modified at or before this time """ sessions_dir = SESSIONS_BASE / agent / "sessions" if not sessions_dir.is_dir(): return [] files = sorted( sessions_dir.glob("*.jsonl"), key=lambda f: f.stat().st_mtime, reverse=True, )python def cmd_list(args): """List sessions with previews.""" agents = [args.agent] if args.agent else discover_agents() start_ts = parse_time(args.start) if args.start else None end_ts = parse_time(args.end) if args.end else None limit = args.limit or 20 offset = args.offset or 0 results = [] for agent in agents: files = get_session_files(agent, start_ts, end_ts)python def cmd_search(args): """Search session transcripts for a query string.""" query = args.query.lower() agents = [args.agent] if args.agent else discover_agents() start_ts = parse_time(args.start) if args.start else None end_ts = parse_time(args.end) if args.end else None limit = args.limit or 30 offset = args.offset or 0 results = [] for agent in a ...[truncated 2595 chars]- Remediation
View remediation
Remediation Suggestions
- Require the runtime to provide a trusted current-agent identifier rather than accepting identity solely from user-controlled command-line input.
- Default both
listandsearchto the authenticated current agent. Never interpret an omitted--agentoption as permission to search all agents. - Reject requests for a different agent unless an explicit, independently validated authorization grant permits cross-agent access.
- Separate administrative enumeration from normal recall operations. The
agentscommand and all-agent searching should be disabled for ordinary agents or protected by a dedicated administrative capability. - Resolve the selected session directory to a canonical path and verify that it remains beneath the authorized agent's canonical sessions directory before opening files.
- Return opaque session identifiers instead of unrestricted absolute paths where possible, and mediate subsequent reads through the same authorization layer.
- Minimize transcript disclosure by redacting likely secrets and limiting previews and snippets to the smallest context needed.
- Add tests confirming that omitted
--agentsearches only the current agent and that attempts to select another agent fail without explicit authorization. - Update
README.mdandSKILL.mdso their documented access model exactly matches the enforced behavior.