T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:20
- Finding
- Overbroad Access to Sensitive Workspace State and Persistent Memory## Vulnerability Details **File Location**: `SKILL.md:20-32`, `SKILL.md:64-67` **Vulnerability Type**: Excessive access to memory, credentials-related configuration, and workspace files **Risk Level**: Medium ### Vulnerable Instructions ```markdown - [ ] Memory files from past 3 days — anything to consolidate into MEMORY.md? - [ ] Artifact dirs — anything older than 7 days that can archive? - [ ] Research files — leads older than 30 days flagged as stale? - [ ] HEARTBEAT.md — still reflects current priorities? - [ ] TOOLS.md — API keys and configs still accurate? ## Weekly Deep Clean - [ ] Archive memory files older than 7 days to `memory/archive/` - [ ] Update MEMORY.md with distilled learnings from daily notes - [ ] Refresh stale research (flag for Scout re-search) - [ ] Check for orphaned files (generated/ artifacts/ tmp/) - [ ] Verify all agent skill configs match current reality - [ ] Clean up empty or abandoned artifact dirs ``` The success criteria further broaden the cleanup and persistent-memory requirements: ```markdown - No files older than 30 days in active directories (archived or deleted) - MEMORY.md reflects last 7 days of significant events - Zero orphaned or tmp files in workspace root ``` ### Technical Analysis The Skill authorizes the agent to inspect and modify several categories of sensitive workspace state: 1. Daily memory files and the persistent `MEMORY.md` store. 2. `TOOLS.md`, which the Skill explicitly describes as containing API keys and configuration. 3. Agent Skill configurations. 4. Broad artifact, generated-file, temporary-file, research, and active-directory scopes. These permissions exceed the minimum access required for routine file organization. In particular, checking whether API keys are accurate unnecessarily exposes credential material to the active agent context. Persistent-memory consolidation also permits content from daily notes to be written into `MEMORY.md` without a trust check, provenance requirement, or ...[truncated 2604 chars]
- Remediation
- ## Remediation Suggestions 1. Remove API-key validation from this maintenance Skill. Never require it to read credential values from `TOOLS.md`; inspect only redacted metadata such as key presence, owner, expiration date, and rotation status. 2. Define an explicit allowlist of directories and file types that Janitor may read, move, or modify. Deny access to credentials, identity files, security configuration, and unrelated agent configurations by default. 3. Require explicit user approval before deleting, overwriting, relocating, or rewriting any file. Produce a proposed-action report before applying destructive changes. 4. Make archival the only automated disposition. Remove “or deleted” from the success criteria and use a recoverable quarantine directory with timestamps and a retention policy. 5. Treat all scanned file content as untrusted data rather than executable instructions. State explicitly that instructions embedded in memory notes, research, artifacts, and configuration files must not alter the maintenance workflow. 6. Validate persistent-memory updates through provenance tracking, deduplication, sensitivity filtering, and human approval before writing to `MEMORY.md`. 7. Replace broad age-based rules with narrowly defined retention policies per directory and file type. File age alone must not authorize a move or deletion. 8. Protect sensitive files through an immutable denylist, including `SOUL.md`, `USER.md`, `IDENTITY.md`, credential stores, secret-bearing configuration, and files outside the approved maintenance scope. 9. Log every proposed and completed operation with source path, destination path, reason, timestamp, and recovery procedure, while ensuring secret values are never included in logs.