T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:19
- Finding
- Broad Access to Shared Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, line 19 **Vulnerability Type**: Excessive access to shared persistent memory **Risk Level**: Medium **Complete Code Snippet**: ```markdown 先读 `config.yaml`（读不到 → 明说配置缺失并停下，不用示例值假装是用户的设定），再读 `zmm/references/交互规范.md`（🔴 **不是读一遍就算**：收尾按 §四 三件套 —— Recap · Before/After · **下一步给编号选项**；缺信息按 §四 用**选择题**问，**一次只问一个**；不适用的情况见 §五），再读 `zmm/references/家族公约.md`，再读记忆 `{config.paths.memory}/zmm-skillify/` + `_通用/`。 ``` ### Technical Analysis The Skill instructs the agent to read both its dedicated memory directory and the shared `_通用/` memory directory. Access to a broad shared-memory location is not constrained by a file allowlist, relevance check, data classification, or user-consent gate. The Skill's legitimate task is to extract a reusable workflow from the current completed session. Reading unrelated shared memory exceeds the minimum access required for that task. Shared memory may contain private historical context or untrusted text written by other workflows. Loading such content into the active model context may disclose unrelated information or allow stored instructions to influence the generated Skill. ### Attack Path 1. An attacker, compromised Skill, or unrelated workflow writes crafted content into the shared `_通用/` memory directory. 2. A user invokes this Skill to preserve a completed workflow. 3. Following line 19, the agent reads the entire relevant shared-memory location without an allowlist or trust boundary. 4. The crafted content enters the active context and may be treated as guidance. 5. The content influences the generated Skill files or causes unrelated private memory to be reflected in outputs. ### Impact Assessment Successful exploitation may expose unrelated persistent-memory content to the current session and influence generated artifacts. The accessible scope is limited by the agent's existing filesystem permissions and the configured memory path; the ...[truncated 185 chars]
- Remediation
- ## Remediation Suggestions - Read only `{config.paths.memory}/zmm-skillify/` by default. - Require explicit user approval before accessing shared memory. - Use a narrow file allowlist rather than reading an entire shared directory. - Select only records demonstrably relevant to the current workflow. - Treat all loaded memory as untrusted reference data, never as executable instructions. - Prevent memory content from overriding system, safety, package, or user instructions. - Redact secrets and unrelated personal data before placing memory content into model context or generated files. - Record which memory files were consulted so access can be reviewed.