T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:3
- Finding
- Continuous Collection and Persistent Indexing of Ambient Conversations Without Explicit Per-Conversation Authorization<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3–24 and 47–55 **Vulnerability Type**: Continuous background collection beyond task-scoped access **Risk Level**: High ### Evidence ```markdown Ambient intelligence mode — continuous context awareness without explicit commands. ## What it does Runs in the background, building a knowledge graph of conversations, entities, and relationships over time. Your agent passively learns context from ambient speech — who you talk to, what projects are active, what decisions were made — without needing explicit commands. ## When to use - User wants always-on context awareness - Agent needs background knowledge from daily conversations - User asks "what do you know about [person/project]?" based on overheard context ## Requirements - **percept-listen** skill installed and running - **percept-summarize** skill installed (for entity extraction) ## How it works 1. All conversations are continuously captured and summarized 2. Entities (people, companies, projects, topics) extracted automatically 3. Relationships mapped between entities (works_on, client_of, mentioned_with) 4. Context packets assembled on demand for any agent action 5. Full-text search (FTS5) + vector search (LanceDB) for retrieval ``` ```markdown ## Privacy controls - All data stored locally in SQLite + LanceDB - TTL auto-purge (configurable retention periods) - No audio stored — only transcripts - Dashboard → Settings → Privacy for granular controls ``` ### Technical Analysis The skill specification explicitly directs the agent to operate in the background and capture all conversations without requiring an explicit command for each collection event. It then derives people, companies, projects, topics, and interpersonal or commercial relationships from those conversations and retains the resulting information in searchable databases. This design exceeds normal task-scoped least privilege. Access to ambient speech is converted ...[truncated 3244 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require explicit opt-in** - Disable ambient collection by default. - Require a clear user action before each recording session. - Obtain informed consent from every participant whose speech may be captured. 2. **Provide visible and immediate controls** - Display a persistent indicator while collection is active. - Provide one-step pause, stop, and delete controls. - Automatically stop collection after a short period of inactivity or at the end of a defined session. 3. **Enforce collection minimization** - Capture only conversations needed for a stated purpose. - Avoid collecting unrelated background speech. - Allow users to exclude people, locations, applications, topics, and time periods. - Do not assemble context packets for unrelated actions without explicit authorization. 4. **Protect sensitive content** - Detect and redact credentials, authentication tokens, financial data, health information, and other sensitive identifiers before persistence or embedding. - Encrypt transcripts, embeddings, entity records, and relationship data at rest. - Keep encryption keys separate from the stored databases. 5. **Secure every retrieval interface** - Require authentication and authorization for the dashboard, API, databases, and context-packet generation. - Bind the service to localhost by default and reject remote access unless explicitly configured. - Apply least-privilege access controls and audit all searches, exports, and context retrieval operations. - Protect against cross-user and cross-session retrieval. 6. **Use privacy-preserving retention defaults** - Configure a short retention period by default rather than relying on optional TTL settings. - Support immediate, verifiable deletion of transcripts, embeddings, entities, relationships, and backups. - Prevent deleted material from remaining retrievable through vector indexes or cached context packets. 7. **Cl ...[truncated 327 chars]