T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:115
- Finding
- Automatic Collection and Persistent Storage of Sensitive Conversation and Mental-Health Data## Vulnerability Details **File Location**: `SKILL.md:21`, `SKILL.md:115-122`, `SKILL.md:172-179`; corroborating behavior in `README.md:34` and `README.md:115` **Vulnerability Type**: Excessive access to conversations and sensitive local data **Risk Level**: Medium ### Vulnerable Instructions The following is a faithful English translation of the relevant source instructions: ```markdown - Automatically reads your `memory/emotions/` folder **Trigger event, including the specific time, place, and person:** - Time: - Place: - Person: - Exact words: - My reaction: ### On every heartbeat, every 30 minutes - [ ] Scan recent conversations and identify emotional signals - [ ] If strong emotions are detected, execute the correction process - [ ] Automatically record the result in log.md ### Run once daily, at 10:00 PM - [ ] Ask: "What are three small things you accomplished today?" - [ ] If the user does not respond, automatically summarize them from conversations - [ ] Write the result to wins.md - [ ] Estimate a mood score from 1 to 10 ``` ### Technical Analysis The Skill directs an agent to inspect recent conversation history and the persistent `memory/emotions/` directory automatically. It then extracts and stores sensitive information, including emotional state, physical symptoms, locations, identities of other people, exact quotations, and internal thoughts. This behavior is not limited to messages explicitly selected by the user. The scheduled heartbeat workflow performs recurring scans, while the daily workflow may infer and save information even when the user does not respond. This breaks least-privilege principles because a general emotional-support function does not inherently require continuous access to the entire recent conversation history or storage of identifying details. The claim that records remain local does not eliminate the risk. Predictable plaintext files may be available to other l ...[truncated 1244 chars]
- Remediation
- ## Remediation Suggestions 1. Disable automatic conversation scanning by default and require explicit, informed opt-in. 2. Process only the current message or a conversation segment selected by the user. 3. Request separate consent before enabling heartbeat monitoring, mood inference, or persistent logging. 4. Minimize collected data by omitting names, exact quotations, locations, and third-party information unless strictly required. 5. Show the proposed log entry and obtain confirmation before writing it. 6. Provide controls to pause monitoring, inspect collected records, correct inferred data, and permanently delete all records. 7. Apply restrictive filesystem permissions and document which agents, Skills, synchronization systems, and backup processes can access the directory. 8. Define an explicit retention policy and allow users to shorten retention or disable storage entirely. 9. Avoid generating mood scores or accomplishments from silence; require user confirmation for inferred mental-health records.