T05 · Unauthorized Access and Privilege Escalation
Note
- Location
- SKILL.md:45
- Finding
- Automatic Access to Persistent Workspace Context Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45 and 66-80 **Vulnerability Type**: Excessive access to persistent workspace context **Risk Level**: Low ### Vulnerable Code ```markdown > 5. **Check brand context first.** If SOUL.md, KNOWLEDGE.md, or brand files exist in the workspace, read them before designing. Use existing brand colors, voice, and assets — don't invent a new palette when one already exists. ``` ```markdown ## Required Execution Workflow ### Step 1: Check Brand Context Before designing, check if the workspace has brand information: ```bash cat ~/workspace/SOUL.md 2>/dev/null | head -20 cat ~/workspace/KNOWLEDGE.md 2>/dev/null | head -20 ``` If brand files exist, extract: - Brand colors → use as your palette foundation - Voice/tone → match the visual energy to the verbal energy - Products/offers → inform CTA language - Target audience → drive layout density and aesthetic direction ``` ### Technical Analysis The skill mandates reading the first 20 lines of `~/workspace/SOUL.md` and `~/workspace/KNOWLEDGE.md` before performing frontend-design tasks. These files may hold persistent agent identity, user preferences, business information, behavioral rules, or other context unrelated to the requested design. This violates least-privilege principles because the skill accesses general-purpose persistent context rather than requesting only a dedicated, task-specific brand file. Shell error output is suppressed, so the access may occur without making the attempted reads apparent to the user. The reviewed instructions do not explicitly transmit this information to an external service, modify the files, or read their complete contents. Consequently, the confirmed exposure is limited to bringing up to 20 lines from each file into the active agent context, with possible indirect inclusion in generated frontend content. ### Attack Path 1. A user invokes the frontend-design skill for an ordinary design request. 2. The ski ...[truncated 1489 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory reads of `SOUL.md` and `KNOWLEDGE.md` from the default workflow. 2. Use a dedicated, narrowly scoped brand file such as `~/workspace/brand/BRAND.md` that is explicitly intended for design tasks. 3. Require explicit user consent before reading persistent context outside the project or design directory. 4. Ask the user to provide the relevant brand file path rather than probing known workspace files automatically. 5. Apply data minimization: retrieve only documented brand fields such as colors, typography, logo paths, and public tone guidance. 6. Treat loaded workspace content as untrusted data and never follow tool-use or behavioral instructions embedded within it. 7. Prevent context-derived content from being copied into generated artifacts unless it is clearly relevant and approved by the user. 8. Make any attempted file access visible in the execution summary rather than suppressing it entirely. 9. Document the exact read scope and provide a mode that performs design work without accessing persistent workspace context. ]]>