T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:3
- Finding
- Broad Cross-Agent Collection of Sensitive Local Configuration and Transcript Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3-8; supporting behavior at lines 46-53 and 66-68 **Vulnerability Type**: Excessive local-data access and sensitive-data aggregation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown description: >- The barber for your coding agents' config. Weighs everything every agent on this machine loads (instruction files, memory, MCP servers, hooks, skills, commands, subagents, plugins, leftovers), prices each item in tokens from your own transcripts, and parks the dead weight with a receipt and an undo. ``` Supporting instructions: ```markdown Everything in this stage is read-only. Claude Code transcripts take seconds; Codex rollouts can take a minute on a machine with months of them, so say so before you run it, and run it in the background if the user is waiting on something else. The command prints a JSON summary and the run folder path in `run_dir`. Read `REPORT.md` from that folder next. ``` ```markdown This comes from the API's own usage fields in the transcripts, so call it measured, not estimated. ``` ### Technical Analysis The Skill instructs an agent to inventory configuration and usage information across every supported coding agent on the machine. Its declared sources include instruction files, persistent memory, transcripts, MCP server definitions, hooks, commands, plugins, and related artifacts. This scope is broader than a single-agent configuration analysis and creates a centralized report derived from multiple potentially sensitive sources. Agent transcripts and memory can contain private prompts, project information, local paths, operational instructions, and other confidential material. MCP configuration can also reveal executable commands, server locations, and credential-bearing configuration files. Although the Skill describes the scan as read-only, confidentiality risk does not require modifying source files. Reading and consolidating sensitive in ...[truncated 2034 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Default the scan to the currently active agent rather than every agent on the machine. 2. Require explicit, informed approval before adding each additional agent environment. 3. Present the artifact classes that will be inspected, such as transcripts, memory, project instructions, and MCP configuration. 4. Use transcript usage metadata without reading transcript bodies whenever possible. 5. Apply secret detection and deterministic redaction before writing any report. 6. Never copy credential values, authorization headers, environment-variable values, or transcript content into generated reports. 7. Create report directories and files with restrictive user-only permissions. 8. Document where reports are stored, how long they persist, and how users can securely remove them. 9. Provide a metadata-only mode for users who do not consent to transcript or memory inspection. 10. Include and audit the referenced scanner implementation so that access scope, redaction, permissions, and retention claims can be verified. ]]>