T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:14
- Finding
- Uncontrolled Transfer of Sensitive Recording Data to External Services## Vulnerability Details **File Location**: `SKILL.md`, lines 14-50 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### 1. 扫描新增录音 - 路径：`~/Desktop/Obsidian/sky的知识库/00-Inbox/录音文件/Get笔记/` - 范围：最近24小时新增的录音 ### 2. 自动分类（6类） | 类别 | 关键词 | 自动处理 | |------|--------|----------| | 客户沟通 | 客户、报价、合同、合作、GEO、培训、需求 | 调用sales-analyzer诊断 → 更新飞书CRM | | 内部会议 | 内部、会议、对齐、分工、进度、团队 | 生成待办+决策记录 → 同步到滴答清单 | | 渠道合作 | 渠道、推荐、介绍、联盟、合作 | 更新飞书渠道表 → 生成渠道报告 | | 投资决策 | 投资、融资、BP、估值、股权 | 生成投资分析报告 | | 灵感/想法 | 灵感、想法、思路、感悟、启发 | 存入素材库 → 生成选题 | | 内容创作 | 短视频、脚本、素材、选题、公众号 | 存入选题库 → 生成内容大纲 | ### 3. 自动处理流程 输入 → 分类 → 判断是否有价值 → ├─ 有价值 → 调用对应skill处理 │ ├─ 客户沟通 → sales-analyzer → 飞书CRM │ ├─ 内部会议 → 生成待办 → 滴答清单 │ ├─ 渠道合作 → 飞书渠道表 │ ├─ 投资决策 → 投资分析报告 │ ├─ 灵感 → 素材库+选题 │ └─ 内容 → 选题库 │ └─ 无价值 → 跳过 → 输出汇总报告 ### 4. CRM自动更新 - **客户商机表**：新增客户自动录入飞书 - **渠道管理表**：新增渠道自动录入飞书 - **跟进记录**：自动追加最新沟通记录 ``` ### Technical Analysis The Skill instructs an agent to read every recording added to a fixed private Obsidian directory during the preceding 24 hours. It then directs the agent to extract and automatically write information to external systems, including Feishu CRM, Feishu channel tables, and TickTick. The workflow does not specify: - Per-record authorization or consent checks. - User confirmation before external transmission. - An allowlist of permitted destination accounts, workspaces, or tables. - Data minimization or field-level disclosure controls. - Redaction of credentials, personal data, contract terms, financial information, or confidential conversations. - Access-control validation for invoked Skills and external APIs. - A preview or approval step for outbound data. Keyword classification is not a security boundary. A recording containing words such as “customer,” “contract,” “meeting,” or “investment” ma ...[truncated 2453 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before reading each recording or restrict scanning to an expressly approved manifest of files. 2. Display a preview of the exact fields and content that will be transmitted, and require confirmation before every external write. 3. Make source directories configurable and validate them against a narrow allowlist. Do not recursively scan unrelated or user-controlled locations. 4. Allowlist destination service accounts, workspaces, databases, tables, and field identifiers. Reject destinations that have not been administratively approved. 5. Apply data minimization by transmitting only fields required for the selected business purpose. 6. Detect and redact credentials, authentication tokens, financial identifiers, sensitive personal data, and confidential content before invoking downstream integrations. 7. Use separate, least-privilege credentials for Feishu and TickTick. Limit permissions to required records and prohibit broad workspace access. 8. Add provenance metadata and deduplication controls to prevent attacker-planted or repeatedly scanned recordings from producing untrusted or duplicate records. 9. Maintain audit logs identifying the source file, classification result, extracted fields, approving user, destination, timestamp, and external API result. 10. Provide rollback or quarantine functionality for incorrectly generated CRM records and tasks. 11. Security-review the referenced Skills before enabling the workflow, including their external endpoints, authentication scopes, prompt-injection handling, and storage practices. 12. Keep automatic schedules disabled by default and require an administrator to enable them only after source, destination, consent, and retention policies have been configured.