T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:35
- Finding
- Overbroad Collection of Sensitive Agent History## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 35-47 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml description: "Generate a structured daily work digest from session logs and memory files. Use when the user asks for a daily summary, end-of-day recap, work log, or 'what did I do today'. Scans memory/*.md, session transcripts, and git activity to produce a human-readable digest with key accomplishments, decisions, and pending items." ``` ```markdown ### 2. Gather source material Run these in parallel where possible: ```bash # Daily memory note cat memory/YYYY-MM-DD.md 2>/dev/null # Recent memory files from the last 24h find memory/ -name "*.md" -newermt "YYYY-MM-DD HH:MM" 2>/dev/null # Git activity (if workspace is a repo) git -C workspace log --since="YYYY-MM-DD 00:00" --until="YYYY-MM-DD 23:59" --oneline --all 2>/dev/null ``` ### 3. Search session transcripts ``` ### Technical Analysis The skill instructs the agent to access persistent memory files, session transcripts, and repository-wide Git history when producing a daily digest. These sources can contain private conversations, personal information, credentials, confidential repository metadata, and activity unrelated to the requested summary. The memory search is not explicitly constrained to an approved workspace or source allowlist. The transcript search similarly lacks a requirement to limit access to the current user, workspace, or authorized sessions. In addition, the Git command uses `--all`, causing activity from every available branch and reference to be searched even when the current branch would be sufficient. The privacy requirement at `SKILL.md:91` instructs the agent not to include secrets or personal data in the final digest, but this is an output-stage safeguard. It does not prevent sensitive information from first being read ...[truncated 1652 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user consent before reading persistent memory or session transcripts, and identify each source category that will be accessed. 2. Restrict searches to the requested date, current workspace, current user, and explicitly authorized sessions. 3. Replace repository-wide `git log --all` with current-branch history by default. Offer all-branch analysis only as an explicit option. 4. Use an allowlist of approved source paths and reject path traversal, symbolic-link escapes, and files outside the intended workspace. 5. Apply secret and personal-data redaction before source content is added to the model context, rather than relying only on filtering the final digest. 6. Present the selected source files and transcript scope to the user for approval before processing them. 7. Minimize collected content by extracting only relevant metadata or bounded excerpts instead of loading complete notes or transcripts. 8. Record which approved sources support each digest item without reproducing sensitive source content.