T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- references/prompts/recon-agent.md:118
- Finding
- Overly Broad Access to Raw Environment and Credential Files## Vulnerability Details **File Location**: `references/prompts/recon-agent.md:118-124` and `references/prompts/recon-agent.md:148-151` **Vulnerability Type**: Excessive access to sensitive project files **Risk Level**: Medium ### Vulnerable Code ```text ### Step 8: Encryption & Secrets - Grep for: encrypt, decrypt, hash, hmac, crypto, kms, key_ring, cipher - Glob for: .env*, *.env, secrets*, credentials*, *config*.json, *config*.yaml - Check .gitignore for secret files - Search for hardcoded secrets: Grep for patterns like API_KEY=, SECRET=, PASSWORD=, token strings - Check secret management: Secret Manager, Vault, env vars, config files ``` Related instructions expand this access further: ```text ### Step 11: Configuration - Read hosting/server config for security headers (CSP, HSTS, X-Frame-Options) - Grep for CORS configuration: cors, Access-Control, origin - Read all .env* files (note which are gitignored) - Check for security-relevant config: rate limiting, request size limits, timeouts ``` ### Technical Analysis The reconnaissance agent is explicitly instructed to discover and read all `.env` files and broadly search files named `credentials*` and `secrets*`. These files commonly contain production API keys, database passwords, signing keys, cloud credentials, and other authentication material. Reading repository configuration is legitimate for a security audit, but reading every raw value is not always the minimum privilege necessary to determine whether sensitive files exist, whether they are tracked by Git, and what classes of secrets they contain. A local scanner could instead return only the file location, secret type, line number, and a non-reversible fingerprint. The Skill mandates redaction in `references/prompts/config-infrastructure.md`, but the reconnaissance instructions do not impose an equivalent explicit prohibition on copying raw values into recon files or summaries. Recon resul ...[truncated 1947 chars]
- Remediation
- ## Remediation Suggestions 1. Do not read complete secret files during initial reconnaissance. Inspect filenames, Git tracking status, permissions, and redacted scanner output first. 2. Use a local secret scanner that returns only: - File path and line number. - Detected secret type. - Redacted prefix or suffix. - Non-reversible fingerprint for duplicate detection. 3. Add a mandatory rule to every agent prompt stating that raw passwords, tokens, private keys, connection strings, and credential values must never be included in responses, summaries, findings, or artifacts. 4. Require explicit user consent before opening files likely to contain live credentials. 5. Exclude `.env`, credential, key, and secret files by default, with a documented opt-in mode for deeper secret analysis. 6. Prevent raw recon content from being inserted into downstream prompts. Pass only redacted structured summaries. 7. Add an automated post-processing step that scans generated reports for secret patterns before they are saved or displayed. 8. Store security-run artifacts outside tracked source directories by default and create them with restrictive filesystem permissions. 9. Automatically recommend or configure a `.gitignore` rule for `docs/security/runs/`. 10. Clearly distinguish test/example credentials from potentially live values without reproducing either value.