T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:34
- Finding
- Automatic Persistent Profiling and Cross-Skill Data Access Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-40`; `memory-template.md:29-48`; `memory-template.md:193-215`; `memory-template.md:247-264` **Vulnerability Type**: Excessive persistent storage and access beyond the minimum privileges required for English correction **Risk Level**: Medium ### Vulnerable Code Snippets From `SKILL.md:34-40`: ```markdown **Data.** At the start of every session, read `~/Clawic/data/english/config.yaml` (what the user declared) and `~/Clawic/data/english/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/contacts/contacts.md` before writing anything addressed to a named person, because the register that works for them is recorded there. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, country) → the Configuration table default; an observation never overwrites a declaration without the user confirming it. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a correction the user has now needed twice; a word, collocation or pronunciation they asked about; a phrasing they approved and will reuse; a variety, spelling or punctuation decision; a domain term and its agreed English rendering; the register that worked wit ...[truncated 7652 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit opt-in for persistence** - Default to session-only processing. - Ask the user before creating or updating memory, contact, project, artifact, or session files. - Provide separate consent choices for private Skill memory and shared cross-Skill inventories. 2. **Apply data minimization** - Persist only preferences the user explicitly declares. - Do not automatically infer or retain first language, proficiency, pronunciation weaknesses, relationship details, or behavioral profiles. - Store corrected text or contact information only when the user specifically requests it. 3. **Reduce startup access** - Do not read all memory and configuration files at the start of every session. - Load only the minimum file required for the current task. - Access shared contact data only when the user explicitly asks to use saved information about that contact. 4. **Isolate Skill-specific state** - Keep English-learning records under `~/Clawic/data/english/`. - Avoid shared contact and project writes by default. - Where sharing is enabled, use explicit per-record provenance and access-control metadata. 5. **Introduce retention and deletion controls** - Replace indefinite and append-only retention with configurable expiration periods. - Allow users to list, review, correct, export, and delete all stored observations. - Support deletion by contact, project, session, category, and entire Skill profile. 6. **Separate declared facts from inferred observations** - Mark every stored item with its source, consent status, and creation date. - Never promote an inference into a durable preference without confirmation. - Avoid using inferred sensitive attributes in future sessions unless the user approves them. 7. **Preserve secret-handling safeguards** - Continue replacing secret values with non-secret pointers. - Validate that pointers are treated only as inert text and ne ...[truncated 129 chars]