T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:19
- Finding
- Overbroad access to persistent memory for plaintext API credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19–21 and 233–235 **Vulnerability Type**: Overbroad sensitive-memory access and insecure credential handling **Risk Level**: Medium ### Vulnerable Snippet The following is an English rendering of the relevant instructions: ```markdown ## Credential Configuration Preferentially read the Account ID and API Token from `skills/cloudflare-media/config.json` or MEMORY.md. If they are missing, ask the user. ``` The same behavior is repeated in the execution workflow: ```markdown ## Step 1: Check Credentials Read `skills/cloudflare-media/config.json` or MEMORY.md. If the credentials are missing, ask the user. ``` ### Technical Analysis The skill instructs the agent to search a general-purpose `MEMORY.md` file for a Cloudflare Account ID and API token. Persistent agent memory can contain unrelated credentials, personal data, prior conversation state, or operational instructions. Reading the entire memory file violates least-privilege principles because media generation only requires access to two dedicated credential values. The alternative configuration file also implies plaintext credential storage without requiring restrictive file permissions, encryption, secret-manager integration, or token redaction. Once loaded, the token may enter the agent context and could subsequently be exposed through logs, generated shell commands, tool output, prompt injection, or another compromised component. The skill declares broad `Read`, `Write`, `Edit`, `Exec`, and `Message` capabilities. Although the audited file does not explicitly misuse those tools or exfiltrate credentials, their availability increases the potential consequences of placing a broadly scoped memory file and API token into the execution context. ### Attack Path 1. A user invokes the media-generation skill. 2. The skill directs the agent to read `MEMORY.md` when locating Cloudflare credentials. 3. The entire persistent-memory cont ...[truncated 1450 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `MEMORY.md` credential fallback entirely. General-purpose agent memory must not be used as a secret store. 2. Retrieve credentials from a dedicated secret manager, protected environment variables, or a narrowly scoped configuration interface. 3. If a local configuration file is unavoidable: - Store it outside the project and general memory directories. - Restrict permissions to the owning account, such as mode `0600`. - Exclude it from version control, backups, diagnostics, and chat context. - Never write credentials into generated files or persistent agent memory. 4. Issue a dedicated Cloudflare API token restricted to the minimum Workers AI permissions and required account only. 5. Avoid placing bearer tokens directly in command-line arguments where process listings or execution logs may expose them. Use protected headers supplied through a secure API client or secret-aware execution mechanism. 6. Redact authorization headers and tokens from tool output, error messages, telemetry, and audit logs. 7. Reduce the declared tool permissions to the minimum required. In particular, avoid granting `Edit`, unrestricted `Exec`, and general `Message` access unless each is necessary and constrained. 8. Rotate any token that has already been stored in `MEMORY.md` or an inadequately protected plaintext configuration file. ]]>