T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:31- Finding
Broad Conversation and Memory Profiling Without Explicit Per-Run Consent
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:31-54
Vulnerability Type: Privacy-sensitive access to conversation history and persistent Agent memory
Risk Level: MediumVulnerable Code Snippet
markdown ### On Any Conversation 1. **Scan for learnable signals:** - Explicit statements: "I prefer X", "I don't like Y", "Remember that..." - Implicit signals: repeated corrections, consistent tool choices, time-of-day patterns - Decision patterns: chosen option vs rejected alternatives 2. **Extract and classify:** - **Fact** — verifiable statement ("I work at DGA EPM") - **Preference** — subjective choice ("I prefer TypeScript over Python") - **Pattern** — behavioral trend ("always asks for cost estimates before builds") - **Correction** — prior information updated ("actually, it's Teya not Matea in casual context") 3. **Store in appropriate file** using `write` or `edit` tool ### Learning Cycles (Triggered by cron or on-demand) 1. Read last 24h of session transcripts (if accessible) 2. Scan `MEMORY.md` for new entries 3. Check daily memory notes (`memory/YYYY-MM-DD.md`) 4. Extract new intelligence from steps above 5. Update `profile.json` with incremental changes 6. Write daily log to `daily/YYYY-MM-DD.md` 7. Surface summary: "Learned X new facts, Y preferences updated, Z patterns detected"The related instruction at
SKILL.md:15further states:markdown - **Quiet learning** — note observations without being asked, but inform the user brieflyTechnical Analysis
The Skill directs an Agent to inspect every conversation, derive explicit and implicit behavioral information, read recent session transcripts and existing memory, and persist the resulting profile through file-writing tools. This includes inferred preferences, behavioral trends, corrections, time-of-day patterns, and personal facts.
Although local memory analysis is the declare ...[truncated 2296 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed opt-in before enabling transcript scanning or implicit preference analysis.
- Require separate confirmation before each automated learning cycle, unless the user has deliberately enabled a clearly documented schedule.
- Default to storing only facts explicitly marked for retention by the user.
- Disable implicit behavioral profiling by default and expose it as a separate configuration option.
- Restrict reads to conversations or date ranges selected by the user rather than all available recent transcripts.
- Add sensitivity filtering for personal identifiers, employment details, health information, financial information, private communications, and credentials.
- Present proposed profile changes for review before committing them to persistent storage.
- Record provenance for every item, including source file, source date, whether it was explicit or inferred, and confirmation status.
- Provide commands to inspect, correct, export, and permanently delete all stored profile information.
- Enforce retention limits programmatically rather than relying only on written instructions.
- Apply restrictive filesystem permissions to the Synapse data directory and avoid making profiles available to unrelated skills or users.