T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:30- Finding
Overbroad Access to Agent Memory and Context
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 30
Vulnerability Type: Overbroad access to persistent Agent context
Risk Level: MediumComplete Snippet:
markdown Before spawning anyone, gather real data: scan relevant context you already have access to (memory/context files, anything the user referenced or attached).Technical Analysis
The Skill instructs the Agent to scan any accessible memory or context files without restricting collection to the current conversation, files explicitly selected by the user, or data strictly necessary for the decision being analyzed. This conflicts with least-privilege and data-minimization principles because persistent Agent memory may contain unrelated private information from earlier interactions.
The collected information is placed into a shared context block and reused in later processing stages. As documented elsewhere in the Skill, this block may be sent to multiple sub-agents and to an alternate model provider. Consequently, an overly broad initial read can amplify disclosure across several processing boundaries.
The issue does not grant new operating-system permissions or bypass a technical access-control mechanism. Instead, it directs the Agent to exercise already available access more broadly than the immediate task may require.
Attack Path
- A user or attacker invokes the Skill with
/devilor a matching natural-language trigger. - The Skill directs the Agent to scan accessible memory and context files.
- The Agent retrieves information unrelated to the current decision, potentially including private data from prior conversations.
- That information is incorporated into the canonical context block.
- The context block is copied into prompts for multiple advisors and reviewers.
- If alternate-model routing is available, some of the information may also cross a model-provider boundary without item-specific user consent.
Im
...[truncated 707 chars]
- A user or attacker invokes the Skill with
- Remediation
View remediation
Remediation Suggestions
- Restrict default collection to the current conversation and attachments explicitly selected for the current decision.
- Require informed, explicit consent before reading persistent memory, prior-session records, unrelated context files, or external note stores.
- Enumerate the proposed sources before accessing them and allow the user to approve or reject each source.
- Apply purpose limitation: retrieve only information directly necessary to answer the framed question.
- Minimize and redact secrets, credentials, personal data, and unrelated confidential information before constructing the shared context block.
- Require separate consent before sending any context to a different model or provider, and clearly identify the applicable boundary.
- Prefer derived, narrowly scoped facts over verbatim source content unless exact reproduction is essential.
- Add a guardrail such as:
markdown Use only the current conversation and attachments the user explicitly selected. Do not inspect persistent memory, prior conversations, or unrelated context files without first listing the specific sources and obtaining explicit user consent. Before sending context to sub-agents or another provider, remove information not necessary for the decision and redact sensitive data.- Record which approved sources contributed to the context block so the user can review the provenance and disclosure scope.