T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:60- Finding
Unnecessary Access to User Profile and Long-Term Memory Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:60-63
Vulnerability Type: Excessive access to potentially sensitive user context
Risk Level: MediumVulnerable Code Snippet
markdown ### Phase 1: Profile the Student Check USER.md / MEMORY.md first. Only ask what is missing: - Learning goal (what problem to solve) - Learning style (fragmented / continuous / daily)Technical Analysis
The Skill instructs the agent to read the general-purpose
USER.mdandMEMORY.mdfiles before asking the user for course-specific information. Such files can contain personal information, preferences, prior conversation details, confidential project context, or other data unrelated to the requested teaching task.This violates the principle of least privilege because the legitimate task requires only a learning goal and preferred learning schedule. The instruction does not limit access to specific fields, require explicit user consent, or prohibit unrelated memory content from being incorporated into generated lessons, reports, or progress records.
No code was found that transmits this information over a network. The identified risk is unnecessary local disclosure to the active Skill context and possible propagation into locally generated course artifacts.
Attack Path
- A user submits a request that activates the Master Teacher Skill.
- During Phase 1, the Skill directs the agent to inspect
USER.mdandMEMORY.md. - The agent reads information beyond what is necessary to establish the user's learning goal and schedule.
- Unrelated sensitive information enters the active model context.
- That information may influence responses or be reproduced in lesson content, progress state, tracking files, or lesson reports.
- Anyone with access to those generated artifacts may consequently gain access to information that was not intentionally provided for the course.
Impact Assessment
The Ski ...[truncated 544 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional instruction to inspect
USER.mdandMEMORY.md. - Ask the user directly for the two required items: their learning goal and preferred learning schedule.
- If stored preferences are supported, require explicit consent before accessing them.
- Restrict access to a dedicated, structured set of course-preference fields rather than reading general-purpose memory files.
- Add an instruction prohibiting the use or reproduction of unrelated memory content in lessons, progress records, reports, and research notes.
- Apply data minimization and retention controls so that only information necessary to resume the course is stored.
- Clearly disclose which profile fields will be read, why they are needed, and where derived information will be saved.
- Remove the unconditional instruction to inspect