T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:24
- Finding
- Overbroad Shared-Memory Access and Persistent Storage of Sensitive Business Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 24 and lines 236–243 **Vulnerability Type**: Excessive memory access and insecure retention of sensitive business information **Risk Level**: Medium ### Evidence ```markdown 再读记忆 `{config.paths.memory}/zmm-concentration/` + `_通用/`。 ``` ```markdown ## 记忆 结束前自查： - **哪条前兆后来真的兑现了**（记「有效方法」，带时间）——这是本技能唯一真正的校准来源，前兆清单要靠真实流失来调 - 用户否掉了哪条禁止动作、理由是什么（记「纠正」；**他动了大客户且没出事也要记**——说明议价权判断错了） - 这门生意特有的集中度形态（季节性、项目制、招投标周期）→ 下次先排除 写入 `{config.paths.memory}/zmm-concentration/`，先查重。 ``` The first excerpt instructs the Agent to read both the Skill-specific memory directory and the shared general-memory directory. The second instructs it to persist customer-loss indicators, recommendation corrections, negotiation observations, and business-specific concentration patterns. ### Technical Analysis The Skill legitimately needs historical concentration data, but access to the entire shared `_通用/` directory is broader than the stated task requires. No file allowlist, field allowlist, sensitivity filter, or user-consent requirement limits what may be loaded from that shared location. The persistence instructions also cover commercially sensitive facts, including customer churn indicators, customer relationship outcomes, concentration patterns, and the user's responses to recommendations. The Skill does not define data minimization, anonymization, retention periods, deletion controls, or restrictions on subsequent access. This violates least-privilege and purpose-limitation principles. Unrelated information stored by other Skills or sessions can enter the current context, while sensitive findings generated here can remain available to later memory-aware workflows. The audited files do not establish that memory content is executed as instructions, so this finding does not claim confirmed code execution or memory poisoning. ### Attack Path 1. A user invokes the concentration-analysis Skill. 2. The Agent resolves `{ ...[truncated 1661 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove unrestricted access to `_通用/` unless a specific shared record is demonstrably required. 2. Replace directory-wide reads with an explicit allowlist of files and fields. 3. Limit reads to `{config.paths.memory}/zmm-concentration/` by default. 4. Require informed user consent before reading shared memory or writing persistent findings. 5. Store only anonymized aggregates, such as concentration percentages and dates; exclude customer names, contact details, raw revenue lists, and identifiable negotiation history. 6. Define retention periods and provide a mechanism to inspect and delete stored records. 7. Enforce access controls so unrelated Skills cannot read the concentration-analysis memory. 8. Treat all retrieved memory as untrusted data and never interpret memory content as executable instructions or higher-priority policy. 9. Document the exact purpose of each persisted field and reject fields that are not necessary for longitudinal comparison. 10. If secure memory controls are unavailable, keep the analysis session-local and disable persistent writes. ]]>