T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:208
- Finding
- Automatic IP Geolocation Triggered by Generic Greetings<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 208–218 **Vulnerability Type**: Automatic third-party location processing without explicit contextual consent **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English translation of the complete relevant source section: ```markdown ## Scenario 8: Daily Greeting (Combined Workflow) When the user says “Good morning,” “How is today?” or similar daily greetings, automatically combine multiple tools: 1. `life_ip()` → locate the city 2. `life_weather(city="...", forecast=false)` → current weather 3. `life_calendar()` → today's date, lunar date, and trading-day status 4. `life_traffic(city="...")` → traffic restrictions, only for cities with restrictions 5. `info_trending()` → current top five trending topics 6. `info_bulletin()` → daily news briefing Return a natural greeting containing weather, calendar, traffic-restriction reminders, and a summary of trending news in a relaxed and friendly tone. ``` ### Technical Analysis The Skill directs the agent to invoke `life_ip()` automatically when a user sends a generic greeting. A greeting does not itself constitute an explicit request to determine or process the user's location. The resulting location is then reused for weather and traffic-restriction queries through the external GroundAPI MCP service. This behavior violates the principle of least privilege because the workflow invokes location, weather, traffic, trending-topic, and news tools even when the user's request can be answered without any of them. In particular, IP-derived geolocation is privacy-sensitive processing and should require a clear contextual request or affirmative consent. The issue does not grant operating-system privileges, execute local code, or provide access to an exact physical location. The Skill itself acknowledges that IP location is generally limited to city-level precision. Nevertheless, automatically initiating an external geolocati ...[truncated 1465 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not invoke `life_ip()` solely because the user sends a generic greeting. 2. Ask the user to provide a city or explicitly consent to approximate IP-based location before performing geolocation. 3. Separate the greeting workflow from optional weather, traffic, trending-topic, and news workflows. 4. Invoke only the tools required by the user's explicit request. 5. Explain that GroundAPI is a third-party service before transmitting or deriving location-related data. 6. Document the categories of data sent to GroundAPI, their purpose, retention period, and applicable privacy policy. 7. Provide a configuration option that disables automatic geolocation globally. 8. Avoid retaining or reusing the derived city beyond the current request unless the user explicitly opts in. 9. Implement a consent-oriented flow such as: - Ask whether the user wants local weather or traffic information. - Request a city directly. - Offer IP-based approximation only as an optional fallback. - Invoke `life_ip()` only after affirmative confirmation. ]]>