T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:431- Finding
Unnecessary Access to Persistent Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 431-442
Vulnerability Type: Least-privilege violation through cross-session memory access
Risk Level: MediumVulnerable Code Snippet
markdown ### Memory Search Integration Before starting research, check for relevant prior knowledge:→ memory_search(query="previous research on [topic]") → memory_get(path="memory/YYYY-MM-DD.md") [if relevant date found]
text Use prior findings to: - Avoid duplicate research - Build on previous conclusions - Identify how understanding has evolved - Note persistent gaps from prior researchThe associated tool declaration appears at
SKILL.md:31:markdown | `memory_search` / `memory_get` | Cross-reference prior knowledge | Check MEMORY.md for related context |Technical Analysis
The Skill instructs the agent to search and read persistent memory before conducting research. Access to cross-session memory is not necessary for the declared core functionality of performing literature reviews and web-based research. The instruction therefore exceeds the minimum privileges needed by the Skill.
Persistent memory may contain information from unrelated users, conversations, or prior tasks. The Skill does not require explicit consent before searching this data, define an allowed memory namespace, restrict which records may be opened, or prevent retrieved content from being incorporated into later tool calls.
This is a read-side privilege issue rather than memory poisoning: the reviewed Skill does not write attacker-controlled instructions into persistent memory. No direct malicious collection endpoint was found. Nevertheless, once private memory content enters the research context, it may influence generated search queries, spawned-agent tasks, or the final report.
Attack Path
- A user invokes the Skill for a research topic.
- The Skill automatically calls
memory_searchusi ...[truncated 1161 chars]
- Remediation
View remediation
Remediation Suggestions
Remove
memory_searchandmemory_getfrom the default research workflow. The declared research functionality can operate using user-approved inputs and public sources without persistent-memory access.If cross-session continuity is retained as an optional feature:
- Require explicit, informed user consent before every memory search.
- Explain what memory namespace, date range, and subject will be searched.
- Restrict retrieval to records created for the same user and research project.
- Present matching record metadata before opening the record.
- Retrieve only the minimum required excerpt instead of an entire memory file.
- Treat retrieved memory as confidential by default.
- Prohibit inserting memory-derived content into
web_search,web_fetch, orsessions_spawncalls without separate user approval. - Add redaction controls for credentials, personal data, health information, proprietary material, and other sensitive content.
- Record auditable disclosures of which memory records were accessed and how they were used.