T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:19
- Finding
- Overbroad Cross-Skill Memory Access and Persistent Modification## Vulnerability Details **File Location**: `SKILL.md`, lines 19, 55, 71-73, and 97 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Relevant Skill Instructions The following English rendering preserves the behavior specified by the original instructions: ```markdown Read the memory at `{vault}/08-Skill-Memory/` (all subdirectories—the retrospective Skill is the only Skill spanning the entire family). Retrieve the video's pre-publication record from `_Drafts/` and `06-Topic-Assembly/Topic-Pipeline.md`. 1. Write memory: validated patterns → `08-Skill-Memory/{corresponding-skill}/` (topic patterns go to zmm-topic, hook patterns go to zmm-hook, and writing patterns go to zmm-script); update or deprecate old memories contradicted by the data. 2. Update the data archive: write the video's data back to `01-Raw-Materials/Data/Data-Tracking.md`. 3. Write back to the topic layer: mark validated topics in `06-Topic-Assembly/Topic-Pipeline.md` as "continue the series"; mark failed topics with the reason. Cross-Skill patterns are written to the corresponding Skill directory rather than accumulated in this Skill's own directory. ``` ### Technical Analysis The Skill explicitly requests access to every subdirectory under the shared Skill-memory hierarchy, even though a retrospective analysis of one video ordinarily requires only records associated with that video and the directly relevant topic, hook, and script components. This violates least-privilege principles by exposing unrelated persistent Agent state to the active Skill. The Skill also performs persistent writes across multiple Skill directories and shared data files. Although these writes support its declared learning function, the instructions do not define a path allowlist, per-record authorization, provenance validation, user confirmation, transactional updates, or rollback controls. Cons ...[truncated 1873 chars]
- Remediation
- ## Remediation Suggestions 1. Replace recursive access to all memory subdirectories with retrieval limited to records explicitly linked to the reviewed video and the directly relevant Skills. 2. Define an allowlist of readable and writable paths. Resolve and normalize paths before access, and reject traversal or writes outside approved directories. 3. Separate read and write permissions. Grant write access only to the specific destination required for each confirmed conclusion. 4. Present a proposed change set or file diff and require explicit user approval before modifying cross-Skill memory, analytics archives, or topic-pipeline records. 5. Record provenance for every stored conclusion, including the source video, source metrics, collection time, sample size, confidence, and whether the entry is an unverified hypothesis or a validated pattern. 6. Treat all user-supplied metrics and comments as untrusted input. Validate data types, expected ranges, sample-size thresholds, and consistency before allowing persistent updates. 7. Use transactional writes, version history, and backups so cross-Skill changes can be reviewed and rolled back. 8. Prevent a single observation from becoming an authoritative rule. Enforce the documented requirement that an initial signal remain marked as an unverified hypothesis until independently repeated. 9. Avoid storing raw private-message content unless necessary. Prefer aggregate counts and redact personal or sensitive information. 10. Log every cross-Skill read and write, including the initiating retrospective and the exact records accessed, to support later auditing.