T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:153- Finding
Shared Agent Memory Access Exceeds Skill-Scoped Storage Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 15, 153-184, 307-316, and 417
Vulnerability Type: Shared persistent-memory access without Skill-level isolation
Risk Level: Medium
Classification: T05: Unauthorized Access and Privilege EscalationRelevant Code Snippets
The following are faithful English translations of the relevant source instructions:
Line 15
markdown Trigger: Read `~/.workbuddy/MEMORY.md`. If the current user's configuration section cannot be found, or the configuration status is not marked as configured, start profile setup.Lines 153-184
markdown Storage: `~/.workbuddy/MEMORY.md`, under the current user's configuration section, or a named virtual-user configuration section when multiple users are present. The configuration contains: - Assistant name - City - Climate type - OpenAPI knowledge-base ID - MCP knowledge-base ID - Folder ID - Growing environment - Window orientation - Temperature and humidity information - Heating or air-conditioning information - Reminder time - Plant list - Last watering date - Profile note ID - Log note ID - Profile file path - Log file path - Configuration status On Skill startup, read MEMORY.md, locate the corresponding configuration section, and parse its fields.Lines 307-316
markdown - If IMA is available: - Create the profile and log notes with `import_doc`. - Record the profile note ID and log note ID in MEMORY.md. - If IMA is unavailable: - Create local Markdown files with `Write`. - Record the profile file path and log file path in MEMORY.md. - Use `Read` for later access and `Edit` for append operations.Line 417
markdown Before completion, write the complete configuration into the Skill configuration section of MEMORY.md and mark the configuration status as configured. At minimum, store the city, climate type, growing envi ...[truncated 3351 chars]- Remediation
View remediation
Remediation Suggestions
- Replace global memory storage with a dedicated Skill-owned state file, such as a private application-data directory scoped to
blooming-elf. - Apply restrictive file permissions so only the current user and the Skill runtime can access the state.
- Use a structured, scoped state API that exposes only this Skill's namespace instead of granting access to the complete memory file.
- Obtain explicit user consent before the first persistent read or write, and clearly identify every category of retained data.
- Minimize stored information. Avoid retaining precise location, household environmental details, local paths, or cloud identifiers unless required for an enabled feature.
- Use stable, runtime-provided user identifiers rather than editable names to separate multiple users.
- Validate document identifiers and local paths before use. Restrict local paths to an approved Skill-owned directory and reject traversal outside that directory.
- Parse configuration with a strict structured format rather than matching Markdown headings.
- Perform atomic updates with backups or compare-and-swap semantics to avoid corrupting unrelated state.
- Provide controls to inspect, export, delete, and reset all persistent data associated with the Skill.
- Ensure reminder automations retain the existing explicit-confirmation requirement and store only opaque task identifiers in Skill-scoped state.
- Replace global memory storage with a dedicated Skill-owned state file, such as a private application-data directory scoped to