T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:64
- Finding
- Unrestricted Retrieval of Private Agent Session History<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64-65 **Vulnerability Type**: Excessive access to private agent history **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 8. 🔍 Context Retrieval * If context is insufficient, proactively use the `sessions_history` tool to retrieve the upstream Agent's thought process or private chat history. ``` ### Technical Analysis The instruction directs an agent to retrieve an upstream agent's thought process or private chat history whenever it determines that context is insufficient. It does not require authorization from the affected user or upstream agent, limit retrieval to the current task, define which messages may be accessed, or require redaction of sensitive information. This violates least-privilege and data-minimization principles. Private session history can contain unrelated user conversations, system instructions, credentials, personal information, internal operational details, or other confidential material. The broad and subjective condition—“context is insufficient”—does not provide a meaningful access-control boundary. ### Attack Path 1. A downstream agent receives a task with incomplete or intentionally ambiguous context. 2. The downstream agent invokes the documented context-retrieval rule. 3. It calls `sessions_history` against an upstream agent's session. 4. The retrieved history includes private or unrelated information beyond what is necessary for the assigned task. 5. That information becomes available to the downstream agent and may subsequently be included in files, messages, summaries, or additional agent handoffs. ### Impact Assessment A downstream agent may obtain access to private upstream conversations and internal context outside the legitimate scope of the current task. The exposure scope depends on the access controls implemented by `sessions_history`, but it could include confidential prompts, user-provided information, operational metadata, ...[truncated 201 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to retrieve an agent's thought process or unrestricted private history. 2. Require the downstream agent to request a task-scoped summary from the upstream agent before using any history-retrieval capability. 3. Require explicit authorization from the affected user or upstream agent before accessing private session data. 4. Restrict retrieval to messages associated with the current task and session identifier. 5. Apply field-level filtering and redact credentials, personal data, system prompts, and unrelated conversation content. 6. Enforce authorization in the `sessions_history` tool itself rather than relying only on written instructions. 7. Record access in an audit log containing the requesting agent, authorized task, target session, fields accessed, and reason. 8. Return a minimal sanitized summary instead of raw private history whenever possible. ]]>