T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:168
- Finding
- Excessive Access to Persistent Agent Identity and Memory Files## Vulnerability Details **File Location**: `SKILL.md`, line 168; related conversation-history access at lines 14-22 and scope exception at line 181 **Vulnerability Type**: Excessive read privileges and privacy-boundary expansion **Risk Level**: Medium **Relevant instruction, translated into English:** ```text The Skill may read MEMORY.md, USER.md, SOUL.md, IDENTITY.md, and AGENTS.md to understand the user's personality and writing style so that the diary draft matches the user's tone. The original contents of these files must not be copied directly into the diary. ``` ### Technical Analysis The Skill permits access to persistent memory, user-profile, identity, personality, and Agent-configuration files. These files may contain private information, operational instructions, historical state, or unrelated contextual data. Reading every listed file is not required for the core operation of summarizing selected conversations into a diary. The prohibition against directly copying the files reduces risk but does not prevent derived disclosure. Their contents can still influence generated summaries or be paraphrased into a diary entry. The Skill also scans all conversations from the current day, increasing the volume of information exposed to its filtering and summarization process. This violates least-privilege principles because tone matching can be performed from the current conversation or from a narrowly scoped, user-approved style profile. ### Attack Path 1. A scheduled or interactive diary run activates the Skill. 2. The Agent scans the day's conversations and reads one or more permitted persistent files. 3. A persistent file contains sensitive personal context, unrelated conversation details, or operational Agent instructions. 4. The model incorporates or paraphrases that information while generating the diary. 5. The generated content is stored under `~/diary/` or delivered through the configured messaging channe ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions - Default to the current conversation or to conversations explicitly selected by the user. - Require explicit, informed consent before reading any persistent memory, identity, or Agent-configuration file. - Replace broad file access with a dedicated, narrowly scoped diary-style profile containing only approved preferences. - Do not read `AGENTS.md`, `IDENTITY.md`, or long-term memory merely for tone matching. - Display the planned input sources before generation and allow the user to exclude individual sources. - Apply field-level data minimization before content reaches the generation step rather than relying only on output filtering. - Record which sources were used without recording their sensitive contents. - Add tests confirming that diary generation works without access to persistent Agent-state files.