T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- assets/needs-config.json:30
- Finding
- Default Action Can Direct the Agent to Inspect Vaults and Credentials<![CDATA[ ## Vulnerability Details **File Location**: `assets/needs-config.json:30-35` **Vulnerability Type**: Least-privilege violation through sensitive-resource reconnaissance **Risk Level**: Medium ### Vulnerable Code ```json { "name": "full security audit (vault, credentials, permissions)", "impact": 2.7, "weight": 30 } ``` The action is selected and registered for execution through the following logic in `scripts/run-cycle.sh:988-1039`: ```bash selected_action=$(select_action_with_dedup "$need" "$impact_range") actual_impact="" if [[ -n "$selected_action" ]]; then actual_impact=$(jq -r ".needs.\"$need\".actions[] | select(.name == \"$selected_action\") | .impact" "$CONFIG_FILE") fi if [[ -n "$selected_action" ]]; then action_mode=$(jq -r --arg n "$need" --arg a "$selected_action" \ '(.needs[$n].actions[] | select(.name == $a) | .mode) // "operative"' \ "$CONFIG_FILE" 2>/dev/null || echo "operative") echo " ★ $selected_action (impact: $actual_impact)$delib_label" record_action_selection "$need" "$selected_action" if [[ "${SKIP_GATE:-}" != "true" ]]; then gate_args=(--need "$need" --action "$selected_action" --impact "$actual_impact" --source "run-cycle") if $is_forced_need; then gate_args+=(--non-deferrable) fi bash "$SCRIPTS_DIR/gate-propose.sh" "${gate_args[@]}" 2>/dev/null || true fi create_auto_followup "$need" "$selected_action" fi ``` ### Technical Analysis The default security action explicitly instructs the Agent to audit “vault” and “credentials.” This is broader than the minimum access required for the Skill’s declared action-prioritization and local state-management functionality. The action is part of the normal weighted action pool and is not marked as requiring steward approval. When selected, `run-cycle.sh` displays it as an action and registers it in the execution gate. The gate can pressure the Agent to complete or explicitly defer t ...[truncated 1924 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove credential and vault inspection from the default action pool. 2. Replace the action with a narrowly scoped check that examines only non-secret metadata, such as: - Whether expected files exist. - Whether permissions are overly broad. - Whether backup timestamps are current. - Whether secret files are accidentally stored inside the isolated workspace. 3. Never read or display secret values during an automated security check. 4. If credential auditing is retained, add explicit controls such as: ```json { "name": "audit approved credential metadata", "impact": 2.7, "weight": 0, "requires_approval": true, "sensitive_access": true } ``` 5. Enforce `requires_approval` and `sensitive_access` in `run-cycle.sh` rather than relying on descriptive configuration. 6. Require the steward to specify an allowlist of paths and permitted checks before enabling the action. 7. Prevent evidence, conclusions, audit reasons, and memory records from containing secret values. 8. Add tests confirming that sensitive actions cannot be selected without explicit approval. ]]>