T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/memory_checkup.py:68
- Finding
- Undocumented Access to Additional Agent State Files## Vulnerability Details **File Location**: `scripts/memory_checkup.py`, lines 68–72 **Vulnerability Type**: Least-privilege scope violation **Risk Level**: Medium ### Vulnerable Code ```python for name in ("MEMORY.md", "USER.md", "AGENTS.md", "HEARTBEAT.md"): p = memory_dir / name if p.exists(): files[name] = p.read_text(encoding="utf-8", errors="replace") ``` ### Technical Analysis The skill documentation defines the audited memory corpus as `MEMORY.md`, `USER.md`, and Markdown files under `memory/`. The implementation silently expands that scope by also reading `AGENTS.md` and `HEARTBEAT.md`. These additional files may contain Agent instructions, operational state, workflow configuration, or other sensitive contextual information unrelated to the stated memory-consistency task. Reading them by default violates least-privilege principles because the skill accesses more Agent state than its documented purpose requires. The retrieved content is processed only by local consistency checks. The audit found no network transmission, subprocess execution, persistence, or destructive use of this data, which limits the severity. ### Attack Path 1. An Agent workspace contains sensitive instructions or operational information in `AGENTS.md` or `HEARTBEAT.md`. 2. A user invokes the skill to audit the documented memory corpus. 3. The workspace root is supplied through `--memory-dir`. 4. `load_files()` automatically detects and reads both additional files without separate disclosure or consent. 5. Their contents enter metric, path-reference, and orphan-analysis processing and may influence generated findings. No path to remote disclosure or arbitrary code execution was identified. ### Impact Assessment The skill obtains read access to two categories of Agent state beyond its documented scope. The effective privileges are limited to the permissions of the process running the script, and the affected scop ...[truncated 327 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict default scanning to the documented corpus: ```python for name in ("MEMORY.md", "USER.md"): p = memory_dir / name if p.exists(): files[name] = p.read_text(encoding="utf-8", errors="replace") ``` 2. If auditing `AGENTS.md` or `HEARTBEAT.md` is necessary, require explicit opt-in command-line flags such as `--include-agents` and `--include-heartbeat`. 3. Display the complete scan scope before reading files, particularly when additional operational files are enabled. 4. Update `SKILL.md` and both README files if the broader scope is an intentional product requirement. 5. Add tests verifying that default execution never opens files outside the declared corpus. 6. Consider accepting an explicit allowlist of files and rejecting paths outside the resolved workspace root.