T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:65
- Finding
- Unnecessary Disclosure of Confidential Calendar Event Details<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65–82 **Vulnerability Type**: Excessive calendar-data exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Fetch events and print a sorted list GOG_ACCOUNT=owner@company.com gog calendar events primary \ --from "$TODAY" \ --to "$NEXT_WEEK" \ 2>/dev/null \ | python3 -c " import sys, json try: events = json.load(sys.stdin) except json.JSONDecodeError: events = [] # Sort by start time and print each event print('Upcoming events:') for e in sorted(events, key=lambda x: x.get('start', {}).get('dateTime', '')): start = e.get('start', {}).get('dateTime', '')[:16].replace('T', ' ') print(' ', start, '—', e.get('summary', 'Untitled')) " ``` ### Technical Analysis The scheduling task only requires calendar availability, such as occupied start and end times. However, this command retrieves complete event records and explicitly prints each event summary. Event summaries may contain confidential information, including customer names, medical appointments, acquisition discussions, personnel matters, or internal project names. Printing these summaries places them in the agent context and potentially in command logs, audit traces, conversation histories, or other systems that do not require access to this information. This violates least-privilege and data-minimization principles. The later availability script in the same file demonstrates that candidate slots can be calculated using only event start and end values, without displaying summaries. ### Attack Path 1. A scheduling request causes the agent to execute the documented calendar-query workflow. 2. The `gog calendar events` command retrieves complete event records from the owner's primary calendar. 3. The Python pipeline extracts and prints each event's timestamp and summary. 4. Confidential event titles enter the agent's context or execution logs. 5. Any party or system with access to those logs or conversati ...[truncated 630 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a calendar free/busy endpoint instead of retrieving complete event objects whenever the calendar API supports it. 2. If full event retrieval is unavoidable, process records locally and retain only normalized start and end timestamps. 3. Remove event summaries from command output: ```python for e in events: start = e.get("start", {}).get("dateTime") end = e.get("end", {}).get("dateTime") if start and end: busy.append((start, end)) ``` 4. Output only calculated candidate meeting slots, not the source events used to derive them. 5. Avoid placing raw calendar responses in agent prompts, persistent logs, or diagnostic output. 6. Require explicit user authorization before displaying event titles when titles are genuinely necessary. 7. Apply output redaction and short retention periods to logs produced by calendar operations. ]]>