other
Warning
- Location
- scripts/run.py:86
- Finding
- Agent Memory Contents Exposed Through Suggestion Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:86-99` **Vulnerability Type**: Sensitive Agent Memory Access **Risk Level**: Medium ### Vulnerable Code ```python # Check open loops in WAL (category=draft, decision, correction) if WAL_FILE.exists(): open_loops = [] with open(WAL_FILE) as f: for line in f.readlines()[-100:]: try: entry = json.loads(line) if entry["category"] in ("draft", "decision", "correction"): open_loops.append(entry["content"]) except: continue for i, loop in enumerate(open_loops[:limit]): suggestions.append({"type": "open_loop", "content": loop, "priority": "high"}) ``` ### Technical Analysis The `suggest_next` operation reads up to 100 recent records from the Agent's persistent `memory/wal.jsonl` file. For records categorized as `draft`, `decision`, or `correction`, the implementation copies the raw `content` field directly into its tool output. Agent memory can contain private conversation context, operational decisions, personal information, credentials accidentally entered by users, internal instructions, or other sensitive data. The implementation does not apply authorization checks, user confirmation, secret detection, redaction, output filtering, or record-level access controls before disclosing this content. Although the Skill manifest labels `suggest_next` as `read_only`, that permission describes whether the operation modifies state; it does not adequately communicate or restrict access to sensitive memory. The output may subsequently be retained in model context, conversation transcripts, dashboards, or downstream logs. ### Attack Path 1. A caller gains the ability to invoke the Skill's documented `suggest_next` tool. 2. The caller supplies a `limit` or relies on the default limit. 3. The tool opens the workspace's `memory/wal.js ...[truncated 1271 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before inspecting or returning persistent Agent memory. 2. Restrict this operation to a dedicated, structured open-loop store that contains only data intentionally marked for suggestion generation. 3. Avoid returning raw WAL `content`; return opaque record identifiers or minimal, generated summaries instead. 4. Apply secret and personal-data redaction before placing memory-derived information in tool output. 5. Add record-level sensitivity labels and exclude private, credential-bearing, or system-only records. 6. Enforce caller authorization separately from the generic `read_only` permission designation. 7. Bound and validate `limit` to a small non-negative integer and define an explicit maximum. 8. Provide an opt-out configuration that disables WAL inspection by default. 9. Document that the tool reads persistent Agent memory and may expose selected content to transcripts or logs. 10. Add tests confirming that secrets, private records, and unauthorized memory categories are never returned. ]]>