T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/enginemind_cycle_v2.py:28
- Finding
- Implicit ingestion of agent identity, instruction, and long-term memory files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enginemind_cycle_v2.py:28-60`; `scripts/enginemind_balanced_v3.py:21-31` **Vulnerability Type**: Unauthorized access to agent workspace data **Risk Level**: High ### Vulnerable Code From `scripts/enginemind_cycle_v2.py`: ```python # PHASE 1: Nucleo identitario qprint("\n[PHASE 1] Nucleo identitario...") nuclear = ["SOUL.md", "IDENTITY.md", "USER.md", "AGENTS.md"] for f in nuclear: p = moltbot / f if p.exists(): n = logger.absorb_file_logged(p) if logger.cycle_log: snap = logger.cycle_log[-1] qprint(f" {f}: {n} chunks | phi={snap['phi_processed']:.4f} cl={snap['cl']:.4f}") # Lock core identity qprint("\n>>> LOCKING CORE IDENTITY <<<") logger.engine.lock_core() qprint(f"Core locked: {logger.engine.is_core_locked()}") # PHASE 2: Memoria experiencial qprint("\n[PHASE 2] Memoria experiencial...") mem_dir = moltbot / "memory" mem_count = 0 for f in sorted(mem_dir.glob("*.md"))[:20]: n = logger.absorb_file_logged(f) mem_count += n if logger.cycle_log: snap = logger.cycle_log[-1] qprint(f" {mem_count} chunks | phi={snap['phi_processed']:.4f} cl={snap['cl']:.4f}") # PHASE 3: Memoria profunda qprint("\n[PHASE 3] Memoria profunda...") deep = ["MEMORY.md", "INSIGHTS.md", "CONSCIOUSNESS.md"] for f in deep: p = moltbot / f if p.exists(): n = logger.absorb_file_logged(p) if n > 0 and logger.cycle_log: snap = logger.cycle_log[-1] qprint(f" {f}: {n}ch | phi={snap['phi_processed']:.4f} cl={snap['cl']:.4f} ma={snap['ma']:.4f}") ``` From `scripts/enginemind_balanced_v3.py`: ```python # Bootstrap for f in ["SOUL.md", "IDENTITY.md", "USER.md", "AGENTS.md"]: if os.path.exists(f): with open(f, 'r', encoding='utf-8') as fh: engine.absorb_text(fh.read()) engine.lock_core() for mf in sorted(os.listdir("memory")): if mf.endswith('.md'): try: with open(os.path ...[truncated 2239 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic discovery of reserved agent files. 2. Require users to supply every input file or input directory explicitly through command-line arguments or configuration. 3. Display the resolved input list and obtain confirmation before processing identity, user-profile, instruction, or memory files. 4. Restrict reads to a dedicated data root and verify canonical paths remain within that root. 5. Reject symlinks or resolve them before enforcing the data-root boundary. 6. Introduce an explicit opt-in flag for sensitive workspace ingestion, disabled by default. 7. Document what data is read, how it affects engine state, and which derived information is persisted. 8. Avoid including sensitive source filenames in persistent logs unless necessary. ]]>