T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:54
- Finding
- Overbroad Gmail Scanning May Access Unrelated Sensitive Messages## Vulnerability Details **File Location**: `SKILL.md`, lines 54–58; recurring execution is specified at line 91 **Vulnerability Type**: Excessive mailbox access beyond least privilege **Risk Level**: Medium ### Vulnerable Code Snippet ```md ### Step 1 — Gmail scan Scan for bill emails: "bill", "invoice", "statement", "direct debit", "standing order". Extract current amounts and providers. ``` The scan is configured to recur daily: ```md ### When a new bill arrives (Gmail scan, daily) ``` ### Technical Analysis The skill directs the agent to scan Gmail using broad, generic terms such as `invoice`, `statement`, and `direct debit`. These terms may occur in banking, healthcare, business, tax, legal, or other confidential correspondence unrelated to household utility monitoring. The instructions do not require: - A dedicated mailbox label or folder. - A provider or sender allowlist. - User approval before opening each matching message. - Restrictions on which message fields or attachments may be processed. - A mechanism for excluding unrelated financial correspondence. - Defined retention and deletion controls for extracted information. Consequently, an agent with Gmail access may process more mailbox content than is necessary for the declared bill-monitoring purpose. Daily execution increases the frequency and duration of this exposure. Although the skill includes prompt-injection defenses and private-channel delivery rules, those controls do not prevent unrelated messages from being accessed during the initial search and extraction process. ### Attack Path 1. The user enables the skill and grants it access to a Gmail integration. 2. The agent performs a mailbox search using broad terms such as `statement` or `invoice`. 3. An unrelated confidential message, such as a bank statement, medical invoice, or business invoice, matches one of those terms. 4. The agent opens or processes the matched message and extracts amounts and provider information. 5. The ...[truncated 1156 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user authorization before the first mailbox scan and clearly describe the search scope. 2. Restrict monitoring to a dedicated Gmail label or folder, such as `Bill Monitor`. 3. Require users to approve specific provider domains or sender addresses before automatic processing. 4. Replace generic mailbox-wide searches with constrained queries combining approved senders, labels, and expected bill terminology. 5. Present newly discovered senders to the user for confirmation before opening messages or extracting data. 6. Extract only the minimum required fields, such as provider, billing period, amount, and contract end date. 7. Do not open or process attachments unless the user explicitly enables attachment parsing for an approved sender. 8. Add exclusion rules for banking, healthcare, tax, legal, and business correspondence that is outside the skill's purpose. 9. Define retention controls that allow users to inspect, correct, export, and delete extracted bill records. 10. Log which approved message produced each bill record without copying unnecessary email content into local storage. 11. Apply the same sender and label restrictions to the daily recurring scan.