T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:42- Finding
Unnecessary Access to Agent Memory and Session History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 42
Vulnerability Type: Unauthorized access to potentially unrelated session data
Risk Level: MediumVulnerable Code
markdown - Use recent real invocations from memory/session historyTechnical Analysis
The skill instructs the agent to inspect memory or session history when the user does not supply representative test inputs. Prior interactions may contain personal information, credentials, confidential project data, or content unrelated to the current optimization task.
This violates least-privilege principles because suitable alternatives are already available in the surrounding workflow, including examples in the target skill's documentation and prompts supplied by the user. The instruction also lacks requirements for explicit user consent, scope restrictions, data minimization, or redaction before historical content is reused.
Attack Path
- A user invokes the optimizer without providing test inputs.
- Following
SKILL.md, the agent searches its memory or session history for recent invocations. - The selected history contains information unrelated or sensitive to the current task.
- The optimizer uses that information as test input.
- Sensitive content may consequently appear in generated outputs, evaluation results, or the optimization changelog.
This path does not require code execution or an external attacker-controlled server. It relies on the agent following the skill's documented fallback procedure.
Impact Assessment
The instruction may expose data accessible through the agent's memory or current session context beyond what is necessary for skill optimization. Potentially affected information includes prior prompts, generated responses, personal data, confidential business material, and secrets previously placed in conversational context.
The issue does not grant operating-system privileges, establish persistence, or directly exfiltrate data to a ...[truncated 193 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the memory/session-history fallback and prefer test material from the target skill's documentation.
- If no safe examples exist, explicitly ask the user to provide two or three representative inputs.
- If historical data must be used, obtain explicit informed consent before accessing it.
- Restrict access to invocations specifically associated with the target skill rather than general session history.
- Redact credentials, personal data, confidential information, and unrelated context before testing.
- Prevent raw test inputs from being copied into persistent changelogs unless necessary and approved.
A safer replacement would be:
markdown - If suitable examples are unavailable in the skill documentation, ask the user for 2-3 representative test inputs. Do not inspect unrelated memory or session history without explicit user consent.