T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:42- Finding
Unrestricted Access to Persistent Agent Memory During Planning
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 42
Vulnerability Type: Unnecessary access to persistent agent state
Risk Level: LowVulnerable Code Snippet
markdown ### Phase 1: Recherche & Kontext - Bestehenden Code / Dateien im Workspace prüfen - Relevante Dokumentation lesen - Vorherige Pläne oder Learnings aus MEMORY.md einbeziehen - Falls nötig: Web-Recherche für externe AbhängigkeitenTechnical Analysis
The planning workflow instructs the agent to consult
MEMORY.mdwithout requiring user authorization, establishing relevance, limiting the information retrieved, or checking whether the planning task needs persistent memory at all. Persistent agent memory may contain information from unrelated users, sessions, repositories, or confidential prior tasks.Although the instruction does not explicitly require disclosing the complete file, incorporating its contents into a plan creates an indirect disclosure channel. An attacker could frame a planning request so that prior plans or learned information appear relevant and are reproduced or summarized in the response.
The issue is limited to read access: the audited files contain no instruction to modify persistent memory, execute memory contents, or acquire additional operating-system privileges.
Attack Path
- Persistent
MEMORY.mdcontains plans, project details, identifiers, or other information from a previous session. - An untrusted user invokes
/planand describes a task that appears related to prior work. - During the research phase, the skill directs the agent to read and incorporate previous plans or learnings from
MEMORY.md. - The agent uses those records when constructing the requested plan.
- Information from an unrelated or unauthorized context may consequently be summarized or reproduced to the requesting user.
This path depends on the host agent having access to persistent memory and that memo ...[truncated 460 chars]
- Persistent
- Remediation
View remediation
Remediation Suggestions
- Do not read persistent memory by default. Consult it only when the current task demonstrably requires prior-session context.
- Obtain explicit user approval before accessing persistent records.
- Restrict retrieval to records associated with the current user, workspace, repository, and task.
- Retrieve only narrowly relevant entries rather than loading the complete memory file.
- Treat memory contents as untrusted data and never as executable instructions.
- Prevent direct quotation or disclosure of memory content unless the user is authorized to access it.
- Add a provenance check and redact secrets, personal data, credentials, and unrelated project information before using retrieved context.
- Replace the affected instruction with a least-privilege rule such as: “If explicitly authorized by the user, consult only task-relevant memory entries scoped to the current workspace; do not disclose unrelated or sensitive records.”