T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Overbroad Access to Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md:13-16` **Vulnerability Type**: Least-privilege violation through automatic access to general-purpose memory files **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## 自动读取配置 此 Skill 会自动尝试从以下位置读取博客配置： 1. 用户记忆文件（MEMORY.md / USER.md）中的博客域名、路径等 2. 博客目录下的 .git 配置 如果未找到配置，才询问用户。 ``` ### Technical Analysis The skill directs the agent to search `MEMORY.md` and `USER.md` automatically before asking the user for blog configuration. These are general-purpose persistent memory files and may contain unrelated personal information, credentials, operational details, or instructions from previous sessions. The publishing task only requires narrowly scoped values such as a blog path and domain. Reading broad memory stores without explicit consent or field-level restrictions violates least privilege and unnecessarily brings unrelated persistent information into the active execution context. The instructions do not define permitted fields, prohibit use of unrelated content, or require user confirmation. No instruction to transmit memory contents externally was identified, so the confirmed risk is unauthorized or excessive access rather than demonstrated exfiltration. ### Attack Path 1. A user invokes the blog-publishing skill. 2. The skill automatically opens `MEMORY.md` or `USER.md` before requesting configuration. 3. Unrelated persistent information becomes available in the agent's active context. 4. That information may influence execution, appear in generated output, or be exposed through subsequent tool use or error reporting. ### Impact Assessment The affected scope includes any information stored in the accessible memory files. The skill gains read access beyond the minimum data required to publish a Hugo article. The issue does not itself grant new operating-system privileges and does not prove external data disclosure, but it increases confidentiality risk and expands the amount of sensitive co ...[truncated 31 chars]
- Remediation
- ## Remediation Suggestions - Ask the user directly for the blog path and domain instead of searching general-purpose memory by default. - Store publishing configuration in a dedicated file containing only explicitly documented fields. - Require informed user consent before reading `MEMORY.md` or `USER.md`. - If memory access is necessary, retrieve only named configuration keys rather than loading entire files. - Explicitly prohibit using, displaying, logging, or forwarding unrelated memory content. - Validate any retrieved path or domain before using it in filesystem or Git operations.