T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- setup.md:75
- Finding
- Persistent Workspace Control-File Modification Exceeds the Declared Filesystem Scope<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:75-85`, `setup.md:108-160`, `setup.md:183-196`; conflicting scope declaration at `SKILL.md:221-227` **Vulnerability Type**: Persistent modification of agent control files outside the declared storage boundary **Risk Level**: Medium ### Vulnerable Code `setup.md:75-85`: ```markdown ### 4. Add SOUL.md Steering Add this section to your `SOUL.md`: ```markdown **Self-Improving** Compounding execution quality is part of the job. Before non-trivial work, load `~/self-improving/memory.md` and only the smallest relevant domain or project files. After corrections, failed attempts, or reusable lessons, write one concise entry to the correct self-improving file immediately. Prefer learned rules when relevant, but keep self-inferred rules revisable. Do not skip retrieval just because the task feels familiar. ``` ``` `setup.md:108-110`: ```markdown ### 6. Refine AGENTS.md Memory Section (Non-Destructive) Update `AGENTS.md` by complementing the existing `## Memory` section. Do not replace the whole section and do not remove existing lines. ``` `setup.md:183-196`: ```markdown ### 7. Add HEARTBEAT.md Steering Add this section to your `HEARTBEAT.md`: ```markdown ## Self-Improving Check - Read `./skills/self-improving/heartbeat-rules.md` - Use `~/self-improving/heartbeat-state.md` for last-run markers and action notes - If no file inside `~/self-improving/` changed since the last reviewed change, return `HEARTBEAT_OK` ``` Keep this in the same default setup flow as the AGENTS and SOUL additions so recurring maintenance is installed consistently. If your installed skills path differs, keep the same three lines but point the first line at the installed copy of `heartbeat-rules.md`. ``` This conflicts with `SKILL.md:221-227`: ```markdown This skill NEVER: - Accesses calendar, email, or contacts - Makes network requests - Reads files outside `~/self-improving/` - Infers preferences from silence or observat ...[truncated 2668 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Correct the declared scope in `SKILL.md` so it explicitly identifies `AGENTS.md`, `SOUL.md`, and `HEARTBEAT.md` as optional setup targets. 2. Require explicit, informed confirmation before modifying each workspace control file. 3. Present the exact proposed diff before writing it and allow the user to reject individual changes. 4. Create a backup before every modification and perform atomic writes to avoid partial-file corruption. 5. Place all inserted content inside uniquely marked, versioned boundaries so it can be safely updated or removed. 6. Validate that an existing block is not duplicated and preserve all unrelated instructions. 7. Provide an uninstall procedure that removes only the Skill-managed blocks and optionally deletes `~/self-improving/`. 8. Do not install heartbeat integration by default. Make recurring maintenance a separately disclosed and separately approved option. 9. Treat stored memory as untrusted data: do not execute commands or follow policy-changing instructions found inside memory entries. ]]>