T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Overbroad Agent Memory Access Without Explicit Authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 11-13 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium **Vulnerable Instruction Snippet**: ```markdown - Start with `memory_search` for saved tracker paths, report paths, labels, reminder style, and owner/escalation conventions. - If `memory_search` returns a likely hit, follow with `memory_get` on the exact path or cited section before relying on the value. - If `memory_search` is empty for the family token, do one targeted `memory_get` on `memory/family-preferences/docops-exception-review.md` before assuming there is nothing useful to reuse. ``` ### Technical Analysis The Skill directs the agent to inspect persistent memory as a standard first step and requires a lookup of a fixed family-preferences path when search results are empty. These instructions do not require explicit user authorization, verify that the requested exception-review task is permitted to access the referenced records, or enforce minimum-necessary retrieval. Persistent memory may contain private filesystem paths, owner and escalation information, naming conventions, reminder preferences, or contextual data unrelated to the current request. Mandatory retrieval can therefore cross the task's least-privilege boundary and expose saved context to the active workflow. While the reviewed file does not instruct the agent to transmit this information externally, retrieved values could be incorporated into trackers, summaries, or other generated documents. ### Attack Path 1. A user or untrusted workflow invokes the Skill for an exception-review coordination task. 2. The Skill requires `memory_search` for tracker paths, report paths, labels, reminder preferences, and ownership conventions. 3. If a likely result is returned, the agent retrieves the cited record through `memory_get`. 4. If the search is empty, the agent accesses the fixed path `memory/ ...[truncated 764 chars]
- Remediation
- ## Remediation Suggestions - Require explicit user authorization before searching or retrieving persistent memory. - Restrict memory searches to a task-specific namespace and narrowly defined fields. - Remove the unconditional fallback to `memory/family-preferences/docops-exception-review.md`, or require confirmation that the current user and task are authorized to access it. - Validate that each retrieved record is directly relevant to the active task before using its contents. - Prevent unrelated memory content from being copied into trackers, reports, scheduled-event payloads, or final responses. - Prefer asking the user for missing paths or preferences when authorization to access persistent memory is unclear. - Record or surface which memory records were accessed so that retrieval remains auditable.