T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:19
- Finding
- Overbroad Access to Shared Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown First read `config.yaml` (if it cannot be read, explicitly state that the configuration is missing and stop; do not use example values as if they were user settings), then read `zmm/references/交互规范.md` (...), and then read memory from `{config.paths.memory}/zmm-dependency/` plus `_通用/`. ``` The snippet above is an English translation of the instruction at the cited location. The original instruction mandates reading both the Skill-specific memory directory and the shared general-memory directory. ### Technical Analysis The Skill requires bulk access to `{config.paths.memory}/zmm-dependency/` and the shared `_通用/` memory area. Access to the Skill-specific directory is reasonably related to its business-dependency assessment, but mandatory access to the entire shared directory is broader than the declared task requires. Shared persistent memory may contain unrelated conversation history, user profile information, operational data, or records generated by other Skills. The instruction provides no record allowlist, field-level filtering, purpose limitation, or consent check before loading that data into the active model context. This violates the principle of least privilege. No network transmission or deliberate data-exfiltration instruction was identified. The issue is therefore overbroad local data access, not confirmed external exfiltration. ### Attack Path 1. A user invokes the dependency-assessment Skill. 2. The Skill reads `config.yaml` and resolves `config.paths.memory`. 3. Following `SKILL.md:19`, it loads both its dedicated memory and the shared `_通用/` memory directory. 4. Unrelated sensitive records from previous sessions or other Skills enter the active context. 5. Those records may influence the assessment or be unintentionally disclosed throug ...[truncated 840 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict default memory access to `{config.paths.memory}/zmm-dependency/`. 2. Do not bulk-load the shared `_通用/` directory. 3. If shared information is necessary, define an explicit allowlist of permitted records and fields. 4. Request user consent before accessing shared persistent information not created by this Skill. 5. Enforce purpose-based access controls in the host runtime rather than relying only on textual instructions. 6. Load the minimum records needed for the current assessment and discard them from active context when no longer required. 7. Add auditing that records which memory entries were read and why. 8. Apply retention and deletion controls to stored switching costs, operational dependencies, license cycles, and other commercially sensitive information. 9. Preserve redaction when storing or retrieving records, including replacing real counterparty names with neutral identifiers where appropriate.