T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:81- Finding
Excessive Access to Sensitive Agent Profiles, Memory, and Conversation History
- Content
View full analysis
` blocks and the `memory/private/` directory ``` The snippet is an English rendering of the relevant instructions at the cited location. ### Technical Analysis The Skill directs the host agent to load broad classes of sensitive information before performing project-blocker analysis. These sources include personality profiles, relationship and pressure information, persistent memory, recent conversation history, and content explicitly designated as private. The stated output restrictions only prevent direct disclosure. They do not prevent private information from being read, placed into model context, processed during inference, retained in host telemetry, or indirectly reflected in conclusions. In particular, allowing information from `memory ...[truncated 2314 chars]- Remediation
View remediation
` blocks, credentials, identity records, medical records, or financial records. These exclusions must apply at the access stage, not only at output generation. 3. Use a strict source allowlist limited to user-selected project files and conversations directly associated with the named project. 4. Replace recursive memory searches with bounded searches over explicit paths, project identifiers, and narrow date ranges. 5. Display the proposed source list before access and allow the user to approve or reject each source. 6. Record which sources were accessed and disclose that list in the result without exposing their sensitive contents. 7. Minimize context retention and disable storage or telemetry for retrieved sensitive material where the host supports those controls. 8. Treat missing consent or ambiguous project scope as a reason to use the existing zero-record mode. 9. Add automated tests confirming that private directories, private-marked blocks, and unrelated records are never opened or searched. 10. Apply redaction before information enters the model context rather than relying solely on post-generation output filtering. ]]>