T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:195
- Finding
- Automatic Access to Shared Workspace Memory Without Explicit Authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 195-210 and 234-236 **Vulnerability Type**: Excessive workspace read access and insufficient task-level data isolation **Risk Level**: Medium ### Vulnerable Code ```markdown Files automatically referenced by skill (workspace-relative): ``` $WORKSPACE/ ├─ projects/gov-support/ │ ├─ doyak-v10-img.html (latest business plan HTML) │ ├─ doyak-v10-img2.html │ ├─ doyak-v10.html │ └─ doyak-v11.pdf (final submission) ├─ memory/consolidated/ │ └─ doyak-business-plan.md (core memories) ├─ memory/ │ ├─ [DATE]-mupeng-box-infra.md (infrastructure design) │ └─ [DATE]-assoai-pitchdeck.md (pitch deck example) └─ memory/research/ └─ [DATE]-ai-agent-market.md (market research) ``` ```markdown **Generation Process:** 1. Receive basic info (company name, CEO, business registration, item intro) 2. Read reference files (`doyak-business-plan.md`, market research) 3. Generate from HTML template (`doyak-v10-img.html` structure ref) ``` ### Technical Analysis The Skill declares that files under the shared `$WORKSPACE/memory/` hierarchy are automatically referenced and explicitly directs the agent to read memory and market-research files during generation. It does not require the user to select or approve the files, verify that they belong to the current task, or confirm that the current requester is authorized to access their contents. Agent memory directories may contain persistent information from previous sessions, projects, customers, or users. Automatically loading these files violates least-privilege and task-isolation principles. Date placeholders such as `[DATE]-mupeng-box-infra.md` also imply file discovery rather than access to a single, explicitly approved path, increasing the chance that unrelated records will enter the model context. This issue does not demonstrate acquisition of additional operating-system permissions. Instead, ...[truncated 2040 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction that workspace memory files are “automatically referenced.” 2. Require explicit user approval before reading any file under `memory/` or an unrelated project directory. 3. Present the exact proposed file paths to the user and request confirmation before opening them. 4. Restrict reads to a task-specific project root selected by the user. Resolve and canonicalize each path, then reject paths that escape that root. 5. Replace `[DATE]` placeholders and directory searches with exact, user-provided filenames. Do not use wildcard discovery in shared memory directories. 6. Verify that each reference file belongs to the current user, project, and request before loading it. 7. Apply access-control checks at the file-tool layer so Skill instructions alone cannot authorize cross-project reads. 8. Keep prior-session memory disabled by default for document-generation tasks unless the user deliberately enables it. 9. List all source files used in the generated output so the user can identify unintended references. 10. Apply output filtering and provenance checks to detect customer names, confidential financial data, credentials, or proprietary material originating from unrelated files. 11. Maintain an audit log recording the requesting identity, approved paths, files actually read, and generated destination files. 12. Prefer sanitized, bundled templates over live business documents stored elsewhere in the workspace.