T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:33
- Finding
- Overbroad Access to Sensitive Operational Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 33-74 **Vulnerability Type**: Excessive access to process information, API configuration, installed skills, and persistent project context **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 1. Crons — Are they alive and earning their keep? For each launchd agent / cron job / scheduled task: - Is the process actually running? (check PID, plist/cron status) - When did it last fire successfully? - What does it produce? Is that output being consumed by anything? - Is there a newer/better approach that renders this obsolete? **Questions to answer:** - "This cron runs every hour. Has its output file been read in the last 30 days?" - "This watchdog monitors a bot that was killed 2 months ago — is the watchdog still running?" ### 2. Scripts — Dead code? Scan your automation directories for Python/shell scripts: - Last modified date vs last executed date - Scripts referencing killed bots or cancelled APIs - Scripts built for old projects that are now closed - Duplicate scripts doing the same job ### 3. API Keys — Are you paying for something unused? Cross-reference your API inventory against actual script usage: - Any API key configured but never called in the last 30 days? - Any paid subscription that maps to zero active script usage? - Any free-tier key that's been maxed out — is an upgrade worthwhile? Common culprits: data providers, news APIs, notification services, AI APIs at old models. ### 4. Skills — Superseded or never used? Review your installed skills: - Any skill built but never actually invoked? - Any skill replaced by a newer, better version? - Any skill with overlapping functionality that could be merged? ### 5. Memory Files — Stale project context? Review project memory and context files: - Any project memory not updated in 30+ days? - Projects marked "on hold" for 60+ days with no activity? - Contradictions between your main context file and individual p ...[truncated 3061 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before inspecting each sensitive category, especially API configuration, installed skills, and persistent memory. 2. Restrict scans to user-approved directories, scheduler entries, projects, and configuration files through an explicit allowlist. 3. Inspect API key names, provider identifiers, and usage metadata only. Never read, display, log, or store complete credential values. 4. Add mandatory redaction for tokens, passwords, authorization headers, account identifiers, personal information, and sensitive filesystem paths. 5. Exclude memory and context files by default. Make their inspection a separate opt-in operation with clearly stated scope. 6. Define the precise process and scheduler metadata required for health checks instead of permitting unrestricted system enumeration. 7. Ensure generated reports use restrictive filesystem permissions and contain only the minimum information necessary to support cleanup decisions. 8. Add a pre-write review step that detects likely secrets and removes them before creating `state/stack_audit_YYYY-MM-DD.md`. 9. Separate cron-health, API-cost, and project-context audits into independently authorized operations so that invoking one function does not grant access to every data category. ]]>