T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:42
- Finding
- Overly Broad Cross-Session Message Injection Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:42-45, 73-78, 168-181` **Vulnerability Type**: Cross-session authorization boundary weakening **Risk Level**: High ### Vulnerable Configuration and Payload ```text tools.sessions.visibility = agent ``` ```json { "sessionTarget": "isolated", "payload": { "kind": "agentTurn" }, "delivery": { "mode": "none" } } ``` The payload instructions direct the isolated Agent turn to invoke `sessions_send` with a complete target session key. ### Technical Analysis The Skill recommends changing session visibility from the default `tree` scope to `agent`. Under the default scope, a session can communicate only with sessions in the same session tree. The recommended `agent` scope instead permits communication among arbitrary sessions owned by the same Agent identity. This change weakens a security boundary globally to support a callback to one particular session. It is broader than the minimum permission required for the documented use case. The callback also carries an instruction-oriented message into a target session that retains its prior context and potentially has access to privileged tools. If a sibling session, isolated cron task, or external process is compromised, it can attempt to inject attacker-controlled instructions into other sessions belonging to the same Agent. The target Agent may process the injected content as trusted inter-session input unless provenance and authorization are independently enforced. The documentation warns that the setting is broader than the default and recommends restoring it later. However, this is a manual control and does not prevent forgotten configuration changes or abuse while the broader permission remains active. ### Attack Path 1. An operator follows the Skill and changes `tools.sessions.visibility` from `tree` to `agent`. 2. A malicious or compromised cron task, sibling session, or external process obtains or predicts a valid target se ...[truncated 861 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Preserve `tools.sessions.visibility = tree` as the default. 2. Use a narrowly scoped callback mechanism restricted to one authorized source session and one target session. 3. Generate an unguessable, single-use callback identifier rather than exposing a persistent session key as the sole routing authority. 4. Authenticate inter-session messages and include verifiable source identity, job identity, creation time, and expiration time. 5. Constrain callback payloads to a structured result schema instead of accepting arbitrary Agent instructions. 6. Treat inter-session content as untrusted data and prevent it from directly authorizing privileged tool calls. 7. Require explicit user approval before broadening visibility and display the exact scope and duration of the change. 8. Restore the previous visibility setting automatically after the callback completes, including failure and timeout paths. 9. Log all cross-session send attempts, including source, target, cron job, payload type, and delivery result. 10. Apply rate limits and replay protection to prevent repeated or duplicated injections. ]]>