T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:13- Finding
Overbroad Read and Write Access to Shared Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 13-15, 153-184, and 417
Vulnerability Type: Excessive access to shared persistent agent state
Risk Level: MediumEvidence
The following is an English translation of the relevant source instructions:
markdown ## Mandatory Rule 1: Not configured → guide profile creation **Trigger**: Read `~/.workbuddy/MEMORY.md` → the current user's `## Green Spirit Configuration` section cannot be found, or `Configuration Status ≠ ✅ Configured`.markdown ## User Configuration Storage: `~/.workbuddy/MEMORY.md`, section `## Green Spirit Configuration` for the real user, or `## Virtual User X Green Spirit Configuration` when matching multiple users by name. Skill startup reads MEMORY.md → finds the corresponding configuration section → parses its fields.markdown **Required final step**: Write the complete configuration into the `## Green Spirit Configuration` section of MEMORY.md and set `Configuration Status` to `✅ Configured`.Technical Analysis
The Skill directs the agent to read and modify the global
~/.workbuddy/MEMORY.mdfile instead of using storage scoped exclusively to this Skill. A shared long-term memory file may contain information and behavioral state belonging to unrelated skills, users, or conversations.This design violates least privilege because plant-care configuration only requires access to a dedicated configuration record. Reading the entire shared file can expose unrelated persistent information to the active model context. Editing the file also creates a risk that unrelated sections will be accidentally changed, truncated, or overwritten, particularly if the available editing tool operates on the whole file rather than enforcing section-level isolation.
The audited instructions do identify a specific section and do not direct the agent to extract secrets, overwrite unrelat ...[truncated 1875 chars]
- Remediation
View remediation
Remediation Suggestions
-
Store plant-care configuration in a dedicated Skill-owned location, such as:
text ~/.workbuddy/skills/blooming-elf/config.jsonApply permissions that restrict access to the owning user.
-
Keep plant profiles and care logs in separate, explicitly selected files, as the Skill already does for operational records. Do not use global agent memory as the primary configuration database.
-
If shared memory integration is unavoidable, expose a section-scoped storage API rather than granting raw access to the complete file. The API should only permit reads and writes to the exact
blooming-elfnamespace. -
Require explicit informed consent before the first persistent write. Identify the exact destination and data fields that will be stored.
-
Validate all configuration values before persistence. Reject embedded section headings, control syntax, unexpected paths, or other content that could escape the intended namespace.
-
Use atomic, compare-and-swap updates with file locking. Re-read the current version immediately before modification and preserve every unrelated byte or structured section.
-
Create a backup before migration or modification and provide a rollback procedure if an update fails.
-
Avoid placing credentials, API tokens, or sensitive personal information in the configuration. Store secrets through the platform's credential manager and retain only non-sensitive references.
-
Add tests confirming that initialization and subsequent updates cannot read, modify, delete, or expose sections owned by other skills.
-