T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:61- Finding
Overbroad Access to Historical Conversation Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 61–69
Vulnerability Type: Excessive retrieval of historical session data
Risk Level: MediumVulnerable Code
bash # 列出所有会话 sessions_list(limit=50) # 获取会话详情 sessions_history(sessionKey="会话 ID", limit=100) # 按时间范围筛选 sessions_list(activeMinutes=1440) # 最近 24 小时 sessions_list(activeMinutes=10080) # 最近 7 天Technical Analysis
The Skill directs the agent to enumerate up to 50 sessions and retrieve up to 100 historical records from an individual session. Token-usage and cost reporting generally requires aggregate metadata, such as token counts, model identifiers, timestamps, and billing information, rather than complete conversation history.
The instructions do not require explicit user authorization before accessing historical sessions, restrict retrieval to sessions owned or selected by the requesting user, or require metadata-only access. They also provide no procedure for excluding message bodies, secrets, personal information, or other sensitive conversation content from the agent context.
This violates the principle of least privilege because the prescribed data access may exceed what is necessary to calculate usage statistics.
Attack Path
- A user or other caller requests a historical model-usage report.
- The Skill instructs the agent to call
sessions_list(limit=50), enumerating available sessions. - The agent selects session identifiers from the returned collection.
- The agent calls
sessions_history(sessionKey=..., limit=100)for one or more sessions. - Historical messages and potentially sensitive conversation context are loaded even though aggregate metadata would be sufficient.
- The agent processes the retrieved data and may include session identifiers or derived information in a report sent through Feishu.
- Sensitive data is consequently exposed to a broader processing and external-delivery scope ...[truncated 842 chars]
- Remediation
View remediation
Remediation Suggestions
- Use a metadata-only API that returns token counts, model identifiers, timestamps, and costs without returning message bodies.
- Remove
sessions_historyfrom the default reporting workflow. Invoke it only when aggregate metadata is unavailable and the user has explicitly authorized access to the specified session. - Require users to select the intended sessions and time range instead of enumerating all accessible sessions by default.
- Apply minimal result limits and retrieve only fields strictly required for the requested calculation.
- Enforce authorization checks so the caller can access only sessions they own or are explicitly permitted to inspect.
- Redact or pseudonymize session identifiers before displaying or transmitting reports.
- Exclude message bodies, credentials, personal information, tool outputs, and attachments from generated reports.
- Require confirmation before sending usage reports to Feishu or any other external destination, and clearly identify the destination and included fields.
- Add retention limits and avoid storing retrieved history after the calculation is complete.
- Document that historical message access is exceptional and record an audit event whenever such access occurs.