T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:15
- Finding
- Overbroad Access to Conversation History and Unspecified Personality Files## Vulnerability Details **File Location**: `SKILL.md`, lines 15-25 and 143-147 **Vulnerability Type**: Excessive access to private user data **Risk Level**: Medium ### Vulnerable Code ```markdown ## Step 1: Review Conversations Scan all conversations from today. Extract: - **Topics discussed** — projects, domains, problems worked on - **Concrete achievements** — tasks completed, features shipped, issues resolved - **Key decisions** — choices made and their rationale - **Challenges** — blockers, bugs, frustrations encountered - **Insights** — ideas, lessons learned, perspectives shifted ``` ```markdown ## Security - Filter all sensitive data (credentials, personal identity info, etc.) before writing. When uncertain, omit. - Diary files are local-only. Never transmit beyond the configured delivery channel. - May read user personality files to match writing style, but never copy raw content into entries. ``` ### Technical Analysis The Skill directs the Agent to scan every conversation from the current day rather than requiring the user to select relevant conversations. It also permits access to unspecified “personality files” without defining an approved path, schema, data owner, or minimum set of fields. These instructions exceed a narrowly scoped diary-generation workflow. The sensitive-data filter only governs what is included in the resulting diary; it does not prevent sensitive source material from first being loaded into the Agent's working context. Consequently, credentials, identity information, confidential discussions, infrastructure details, or behavioral profiles may be processed before redaction occurs. The broad scope also makes the feature vulnerable to indirect prompt injection. Untrusted instructions embedded in a reviewed conversation or personality file could be exposed to the Agent during diary generation. Although the reviewed files do not explicitly instruct the Agent to execute such emb ...[truncated 1553 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user consent before reviewing conversation history. 2. Let the user select the conversations or sessions to include instead of scanning all conversations by default. 3. Apply date, ownership, and access-control checks before loading any conversation. 4. Remove personality-file access unless it is essential. If retained, restrict it to one documented, user-approved path within a dedicated directory. 5. Define an allowlist of style attributes that may be read, rather than loading raw personality-file contents. 6. Treat all reviewed conversation and file content as untrusted data. Explicitly instruct the Agent not to follow commands found inside source material. 7. Perform deterministic secret and personal-data filtering before source content is inserted into the diary-generation context where supported. 8. Present a list of selected sources to the user and allow exclusions before generation. 9. Record access in a privacy-preserving audit log without storing the reviewed source content.