T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/generate_image.sh:23- Finding
Undocumented Access to Agent Memory Files
- Content
View full analysis
/dev/null | head -1) if [ -n "$LATEST_MEMORY" ]; then POEM_TITLE=$(grep -oE '《[^》]+》' "$LATEST_MEMORY" | tail -1 | tr -d '《》' || echo "") fi fi ``` ### Technical Analysis When the progress file does not provide a poem title, the script enumerates the Agent's memory directory, selects the most recently modified Markdown file, and reads content matching book-title delimiters. This fallback is not declared in the `SKILL.md` data-source section, which identifies the progress JSON and poem archive as the expected sources. Reading the general memory directory exceeds the minimum data access necessary for image generation. Although the extraction pattern limits the text selected, any matching content from an unrelated memory record can become `POEM_TITLE`. That value is subsequently embedded in the image prompt passed to the externally connected `mmx` CLI. ### Attack Path 1. The expected progress JSON is missing, unreadable, empty, or contains no usable final `studied` entry. 2. An unrelated or attacker-influenced Markdown file becomes the newest file in the Agent memory directory. 3. The file contains text enclosed by `《` and `》`. 4. The script extracts the last matching value and treats it as the poem title. 5. The extracted value is inserted into the image-generation prompt. 6. The `mmx image` command submits that prompt to the configured MiniMax service. ### Impact Assessment The script can read information from unrelated Agent memory without explicit user authorization or documentation. The exposed scope is restricted to the final substring matching the extraction pattern, rather than the complete memory file, but tha ...[truncated 284 chars]- Remediation
View remediation