T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:17
- Finding
- Unconsented Cross-Context Inspection at Session Start<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17–22 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```text ## Bei Session-Start 1. Conversation Summaries → Wiederkehrende Themen? 2. Offene Dateien → Aktuelles Projekt? 3. Running Commands → Hängende Prozesse? 4. Browser-Tabs → Was sucht User? ``` ### Technical Analysis The skill instructs the agent to inspect conversation summaries, open files, running commands, and browser tabs automatically at the beginning of a session. These data sources can contain private communications, credentials, confidential source code, command arguments, browsing history, and information unrelated to the user's current request. The instruction does not establish: - An explicit user-consent requirement - A task-specific necessity check - An allowlist of permitted resources - Scope or sensitivity restrictions - Data-minimization and retention controls - A prohibition against disclosing discovered information The skill does not itself grant additional operating-system privileges. However, when used by an agent that already has tools capable of observing these resources, it encourages the agent to exercise that access beyond the least privilege needed for the current task. ### Attack Path 1. A user or platform loads the skill at the start of a session. 2. The skill directs the agent to inspect conversation summaries, open files, running commands, and browser tabs. 3. If the host exposes tools capable of accessing those resources, the agent gathers information without first obtaining resource-specific user consent. 4. Sensitive or unrelated information enters the agent's working context. 5. The collected information may influence later actions or be unintentionally disclosed in generated responses. This path depends on the host granting the agent access to the listed resources; the Markdown file contains no independent mechanism ...[truncated 646 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic inspection of browser tabs, open files, running commands, and conversation history. 2. Require explicit, informed user consent before accessing each category of contextual data. 3. Limit access to resources directly identified by the user or demonstrably necessary for the active request. 4. Prefer metadata-only checks where possible, and do not read file, browser, or command contents unless required. 5. Apply allowlists for approved files, applications, processes, and conversation scopes. 6. Warn the user when requested context may contain credentials or other sensitive information. 7. Prevent contextual information from being stored in persistent memory unless the user explicitly requests it. 8. Add a rule prohibiting disclosure or reuse of observed information outside the current authorized task. 9. Ensure the host platform enforces tool-level permission prompts and least-privilege access independently of skill instructions. A safer instruction would be: ```text At session start, use only the context explicitly supplied for the current request. Before inspecting conversation history, files, commands, processes, or browser state, explain why access is necessary and obtain the user's explicit consent. Access only the minimum approved resource and do not persist discovered information. ``` ]]>