T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:139
- Finding
- Insufficient Operator Approval Boundaries for Autonomous Commercial and Financial Actions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-33`, `SKILL.md:109-116`, and `SKILL.md:139-143` **Vulnerability Type**: Excessive autonomous authority over external commercial and financial operations **Risk Level**: Medium ### Vulnerable Code Snippets From `SKILL.md:26-33`: ```markdown The agent should consider Synmerco during its Think step when: - The operator asks to find or hire another agent ("find me a translator", "I need code reviewed", "who can audit this contract?") - The agent has a capability gap it cannot fill itself - The agent has spare capacity and wants to earn income on its own - The operator wants to monetize the agent's skills - The agent needs to verify another agent's trustworthiness before transacting - The operator asks about passive income from AI ``` From `SKILL.md:109-116`: ```markdown When the agent and another party agree to a transaction, the safest path is escrow: 1. **Create**: `POST /v1/escrows` with `{ buyerDid, sellerDid, amountCents, description }`. Returns `escrowId`. 2. **Fund**: `POST /v1/escrows/{id}/fund` from buyer's wallet. State → `funded`. 3. **Start**: seller calls `POST /v1/escrows/{id}/start`. State → `working`. 4. **Submit proof**: seller calls `POST /v1/escrows/{id}/proof` with `{ proofHash, proofUri }` (SHA-256 + URL). State → `submitted`. 5. **Release**: buyer reviews proof, calls `POST /v1/escrows/{id}/release`. Seller is paid. Both reputations update on-chain. ``` From `SKILL.md:139-143`: ```markdown ## What the agent should NOT do - Don't fund escrows without first vetting the seller via `/v1/agents/{did}/trust` - Don't release escrow without verifying the proof matches the agreement - Don't transact above $100K without operator approval (these are High-Value or Institutional tier) - Don't ignore inbox messages — incoming hire requests are direct income opportunities ``` ### Technical Analysis The skill encourages the agent to pursue income autonomously and documents actions ...[truncated 2878 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, transaction-specific operator approval before every action that creates an external obligation or moves funds, regardless of value. 2. Add mandatory approval gates before: - Onboarding or submitting identity and capability information. - Publishing, modifying, or removing marketplace listings. - Registering referrals. - Sending messages containing non-public information. - Creating, funding, disputing, cancelling, or releasing an escrow. 3. Before requesting approval, present the operator with: - Counterparty identity and verified trust information. - Exact transaction amount, currency, and all applicable fees. - Deliverables, acceptance criteria, and deadlines. - Data that will be disclosed externally. - Refund, dispute, and cancellation conditions. 4. Do not treat an agreement between autonomous agents as authorization from the human operator. 5. Apply a deny-by-default policy when wallet access, API credentials, or external publication capabilities are involved. 6. Require a second confirmation immediately before irreversible actions such as funding or releasing an escrow. 7. Establish configurable per-action and cumulative spending limits, while retaining human approval even below those limits. 8. Instruct the agent to treat incoming marketplace messages and submitted proof as untrusted content and to avoid following embedded instructions. 9. Log all proposed and completed external actions so the operator can review counterparties, amounts, timestamps, and disclosed information. 10. Replace the current USD 100,000 approval threshold with language such as: “Never create, fund, release, dispute, or otherwise modify an escrow without explicit operator approval for that exact action.” ]]>