T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:29
- Finding
- Overprivileged Access to Complete Runtime Context and Global Trace Data## Vulnerability Details **File Location**: `SKILL.md`, lines 29–42 and 129–154 **Vulnerability Type**: Unrestricted runtime-context observation **Risk Level**: Medium ### Evidence The relevant Skill instructions, translated into English, state: ```text You can observe: - Any Skill - Any Agent - Any Prompt Workflow - Any multi-Skill system - Any nested Skill structure ``` The mandatory input fields are: ```text context.trace_logs Read the complete runtime logs context.previous_output Read the most recent output context.data_envelope Read the complete context meta.debug_mode Read the current mode ``` The global collection requirements state: ```text Every Skill must output a trace_log. RuntimeBridge must maintain the global context.trace_logs array. Whenever a Skill outputs a trace_log, append it to context.trace_logs. ``` ### Technical Analysis The Skill claims visibility over any Skill, Agent, workflow, multi-Skill system, and nested Skill structure. It also requires access to complete runtime logs, the previous output, and the full context envelope. These permissions are broader than necessary for a least-privilege debugging function. The design does not define workflow-scoped authorization, field-level access controls, secret filtering, personal-data redaction, trace retention limits, or restrictions preventing one workflow from observing another workflow's data. Requiring every Skill to produce trace records and requiring `RuntimeBridge` to aggregate those records globally further expands the amount and scope of information exposed to the observer. No executable data-exfiltration mechanism was identified. The risk arises from overbroad access and centralized collection: sensitive information could be included in generated reports or exposed to any caller that can invoke the observer and receive its output. ### Attack Path 1. An attacker or unauthorized user satisfie ...[truncated 1329 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict observation to the specific workflow and execution identifier explicitly selected by an authorized user. 2. Replace complete-context access with an allowlist containing only the minimum trace fields required for diagnosis. 3. Apply secret, credential, token, personal-data, and proprietary-content redaction before information enters `context.trace_logs`. 4. Require explicit authorization for debug-mode activation rather than relying solely on user-supplied trigger phrases. 5. Isolate trace arrays by tenant, user, session, and workflow to prevent cross-workflow disclosure. 6. Avoid requiring unrelated Skills to emit global trace records; use scoped, opt-in instrumentation instead. 7. Define retention periods, deletion behavior, access logging, and maximum trace sizes. 8. Ensure generated summaries cannot reproduce raw sensitive inputs, hidden prompts, credentials, or private reasoning data. 9. Enforce these controls in the runtime rather than relying only on natural-language instructions in `SKILL.md`. 10. Add tests confirming that unauthorized callers and unrelated workflows cannot read another execution's context or trace records.