T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:38- Finding
Unbounded Collection and Packaging of Sensitive Project Files
- Content
View full analysis
- Remediation
View remediation
Security audit
llm-session-handoff-assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate project handoff helper, but it asks agents to collect and package broad workspace and conversation data without enough user approval or secret filtering.
Install only if you are comfortable using it for deliberate project export. Before running it, confirm the project root, ask for a file manifest, exclude secrets such as .env files, keys, tokens, credential stores, private databases, hidden files, and unrelated uploads, and review the final package before sharing it with another model, person, or system.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger criteria are intentionally broad and fire on vague 'handoff' or 'summary for later' intent, which can cause the skill to activate when the user did not clearly consent to exporting a full project context. In this skill, activation leads to collecting conversation-derived context and files, so over-triggering materially increases the chance of unintended data disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill's core function is to prepare a handoff bundle for another AI/system by aggregating project context, conversation-derived information, and files. Even if intended as a productivity feature, this is a sensitive cross-boundary data transfer mechanism that can expose confidential material to a different model, vendor, or conversation context if not tightly scoped and consented.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs bulk collection and packaging of project files, uploaded files, and generated artifacts for download without a mandatory privacy/sensitivity review or explicit warning. That creates a clear exfiltration path for secrets, proprietary code, personal data, or unrelated workspace files to be bundled and transferred to another system or person.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs collecting uploaded originals, generated files, and current workspace contents into one deliverable. In context, this is especially dangerous because 'current workspace contents' may include unrelated repositories, credentials, temporary files, or user data that were never meant to be exported, making accidental over-collection likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions tell the model to review the entire conversation history and preserve user preferences and discussion-derived details for transfer. This can capture sensitive behavioral data, internal reasoning context, or private details not necessary for project continuation, increasing privacy risk beyond the minimum needed for handoff.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction requires the content to be written in Chinese terms and phrasing (for example, using fixed Chinese strings like "未知" and the entire template text is prescriptive in Chinese) without indicating that language selection is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content