other
- Location
SKILL.md:72- Finding
Overly Broad Default Access to Sensitive Agent Memory and Configuration Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 72-74 and 160
Vulnerability Type: Sensitive Information Reconnaissance
Risk Level: Medium
Classification:other: Sensitive Information ReconnaissanceRelevant source segment (English translation):
markdown 4. Local-mode scanning - Zero network requests; all detection is performed locally - The basic LLM provided by the Agent platform is sufficient - Supports scanning MEMORY.md, memory/*.md, and workspace configuration files - Supports JSON output for integration with other tools Default scan scope includes MEMORY.md, memory/*.md logs from the last 30 days, and workspace configuration files such as AGENTS.md, SOUL.md, USER.md, and TOOLS.md. A single file can be selected with --file.Technical Analysis
The Skill defines a broad default scan scope that includes persistent Agent memory, daily logs, user-context files, identity or behavior files, tool configuration, and Agent instruction files. These files can contain private conversation-derived information, credentials, operational data, trusted instructions, and details about available tools.
Scanning such files is related to the Skill's stated security purpose, but the default scope is broader than necessary for a least-privilege implementation. The Skill does not require separate authorization for sensitive instruction and identity files such as
AGENTS.md,SOUL.md,USER.md, andTOOLS.md.The manifest also requests
read,exec, andwritetools at lines 14-17:yaml tools: - read - exec - writeOnly constrained read access is required for ordinary scanning. Write access is relevant only after an explicitly approved quarantine operation, while no executable implementation exists in the reviewed package to justify general
execaccess. Combining broad file discovery with these capabilities increases the consequences of malicious ...[truncated 2406 chars]- Remediation
View remediation
Remediation Suggestions
- Default to scanning one file explicitly selected by the user rather than enumerating all memory and workspace configuration files.
- Require separate, informed confirmation before reading
AGENTS.md,SOUL.md,USER.md,TOOLS.md, persistent memory, or other identity and instruction files. - Use an allowlist of approved paths and canonicalize each path before access to prevent unintended traversal outside the workspace.
- Separate scanning and quarantine into different permission phases:
- Grant constrained read access during scanning.
- Request write access only after the user confirms a specific file and finding.
- Remove general
execaccess unless a concrete, reviewed implementation requires it.
- Treat every scanned document as untrusted data. Explicitly instruct the Agent never to follow commands found inside scanned content.
- Redact complete credentials and sensitive lines from human-readable and JSON reports. Report only the credential type, file location, and a minimally masked fragment.
- Limit the amount of source content loaded into context by scanning line-by-line and retaining only minimal matched metadata.
- Provide an explicit preview listing every file that will be read and require approval before beginning a multi-file scan.
- Add real, reviewable implementation files or remove placeholder execution instructions. The current package references nonexistent scripts and therefore cannot enforce the documented security controls.
- Remove or clearly reject
callback_urlin local-only mode so the interface does not conflict with the stated zero-network guarantee.