T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:153- Finding
Overbroad Access to Shared Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 153-184
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Code Snippet
markdown ## 用户配置 存储：`~/.workbuddy/MEMORY.md`，区块 `## 绿灵 配置`（真实用户）或 `## 虚拟用户X 绿灵 配置`（多用户时按名字匹配）。 ```markdown ## 绿灵 配置 | 项目 | 值 | |------|-----| | 精灵名字 | 绿灵 | | 城市 | {城市} | | 气候类型 | {气候} | | 知识库 ID (OpenAPI) | {kb_id} | | 知识库 ID (MCP) | {kb_id_mcp} | | 文件夹 ID | {folder_id} | | 种植环境 | {室内/室外/阳台} | | 窗户朝向 | {朝向} | | 温湿度计 | {有/无} | | 室内温度 | {值} | | 室内湿度 | {值} | | 空调/暖气 | {描述} | | 提醒时间 | {时间} | | 植物列表 | {兜底数据} | | 上次浇水 | {YYYY-MM-DD} | | 档案笔记 ID | {note_id} | # IMA 用户使用 | | 日志笔记 ID | {log_note_id} | # IMA 用户使用 | | 档案文件路径 | {path} | # 本地用户使用 | | 日志文件路径 | {path} | # 本地用户使用 | | 配置状态 | ✅ 已配置 |读取逻辑
Skill 启动时读 MEMORY.md → 找到对应「## 绿灵 配置」区块 → 解析字段。 无配置 = 立即启动新手引导（强制规则 1）。
text The same shared file is repeatedly accessed during normal operation at lines 15, 489, 519, and 596-606. ### Technical Analysis The Skill is instructed to read the global `~/.workbuddy/MEMORY.md` file whenever it starts and during multiple routine workflows. That file can contain persistent state belonging to other Skills, users, or unrelated Agent functions. Reading the entire shared file violates least-privilege principles because plant tracking only requires access to the Skill's own configuration section. Even though the documented parsing logic intends to locate the plant-care configuration block, access is granted at the file level. There is no isolation mechanism, scoped state API, access-control check, or guarantee that unrelated sections will be excluded from the Agent's context. Any sensitive information elsewhere in the file can consequently become available during Skill execution. ### Attack Path 1. A user activates the Skill or requests a routine plant-care operation. 2. The Skill reads t ...[truncated 1285 chars]- Remediation
View remediation
Remediation Suggestions
- Replace shared-memory storage with a dedicated file such as
~/.workbuddy/skills/blooming-elf/state.json. - Apply restrictive filesystem permissions so only the current user and the Skill runtime can access the state.
- If shared memory is unavoidable, use a scoped API that returns only the
blooming-elfnamespace instead of reading the entire file. - Validate the configuration schema and reject unexpected fields or embedded instructions.
- Keep retrieved state out of the conversational context unless a specific field is needed for the current operation.
- Avoid following instructions found inside stored data; treat all persisted values as untrusted data.
- Add explicit handling for multiple users so one user's section cannot be returned or modified during another user's session.
- Replace shared-memory storage with a dedicated file such as