T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:429- Finding
Unconsented Cross-Session Memory Access
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 429-436
Vulnerability Type: Cross-session memory access beyond minimum required privileges
Risk Level: MediumVulnerable Code
text ### Memory Search Integration Before starting research, check for relevant prior knowledge: → memory_search(query="previous research on [topic]") → memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]Technical Analysis
The Skill instructs the Agent to search and retrieve persistent memory before beginning web research. This access is not necessary for the Skill's core function of researching public sources, and the instructions do not require explicit user consent, verify ownership of retrieved records, restrict retrieval to research-specific notes, or assess whether the records contain sensitive information.
Topic-based matching can retrieve information from previous sessions that is personal, confidential, unrelated to the current request, or outside the current user's authorized scope. Retrieved information may then influence the current analysis, appear in the final report, or be included in context supplied to parallel research agents.
The reviewed instructions do not explicitly direct the Agent to send memory contents to external websites. Therefore, this finding concerns excessive access and possible cross-session disclosure rather than confirmed network exfiltration.
Attack Path
- A user requests deep research on a topic that overlaps with sensitive material stored during a previous session.
- Following the Skill instructions, the Agent invokes
memory_searchwithout first obtaining consent or establishing an authorized memory scope. - The search returns a reference to a persistent dated memory file.
- The Agent invokes
memory_getand retrieves the matching record. - Information from the prior session enters the current research context.
- The information may affect the report, be disclosed to the current u ...[truncated 691 chars]
- Remediation
View remediation
Remediation Suggestions
Require explicit user approval before accessing persistent memory. At the research-planning checkpoint, disclose the proposed memory query, explain why prior records are needed, and allow the user to continue without memory access.
Restrict retrieval to records explicitly designated as research notes for the same user and project. Apply ownership, tenant, session, and sensitivity checks before returning any result. Avoid retrieving complete memory files when a narrowly scoped excerpt or metadata result is sufficient.
Do not include retrieved memory content in web-search queries, external fetch requests, or spawned-agent task descriptions unless the user separately authorizes that disclosure. Redact personal data, credentials, proprietary information, and unrelated context before any delegation.
Record which memory entries were accessed and identify their use in the research methodology. Provide a memory-free operating mode as the default, with persistent-memory integration enabled only through informed opt-in.