T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/memory_checkup.py:67- Finding
Undeclared Access to Agent Control Files
- Content
View full analysis
Vulnerability Details
File Location:
scripts/memory_checkup.py:67-78
Vulnerability Type: Excessive file-read scope
Risk Level: LowVulnerable Code
python def load_files(memory_dir: Path): """Scan workspace-root markdown files plus the memory/ subdirectory only. Never recurse into other subdirectories (skills/, node_modules/, projects/).""" files = {} for name in ("MEMORY.md", "USER.md", "AGENTS.md", "HEARTBEAT.md"): p = memory_dir / name if p.exists(): files[name] = p.read_text(encoding="utf-8", errors="replace") memsub = memory_dir / "memory" if memsub.exists() and memsub.is_dir(): for p in sorted(memsub.glob("*.md")): files[str(p.relative_to(memory_dir))] = p.read_text(encoding="utf-8", errors="replace") return filesTechnical Analysis
The documented audit corpus consists of
MEMORY.md,USER.md, and Markdown files undermemory/. However,load_files()also readsAGENTS.mdandHEARTBEAT.mdautomatically whenever those files exist.These additional files may contain agent instructions, operational schedules, or control-state information rather than user memory. Reading them violates least-privilege and declared-scope principles because they are not required by the documented memory-consistency task and no explicit opt-in is requested.
The loaded contents are processed by metric, path-reference, date, and orphan-detection logic. Findings derived from those files may consequently appear in human-readable or JSON output. The implementation does not transmit data over a network, execute content from these files, or acquire operating-system privileges beyond those already held by the invoking process.
Attack Path
- A user or agent invokes the script with
--memory-dirpointing to an agent workspace. - The workspace contains readable
AGENTS.mdorHEARTBEAT.mdfiles. load_files()silently opens and reads those files despite th ...[truncated 869 chars]
- A user or agent invokes the script with
- Remediation
View remediation
Remediation Suggestions
- Restrict the default root-file list to the documented corpus:
python for name in ("MEMORY.md", "USER.md"): p = memory_dir / name if p.exists() and p.is_file(): files[name] = p.read_text(encoding="utf-8", errors="replace")-
If auditing
AGENTS.mdorHEARTBEAT.mdis a legitimate optional feature, require explicit consent through a flag such as--include-control-files. -
Clearly document every file category read by the script, including how content may be represented in human-readable and JSON reports.
-
Consider accepting an explicit allowlist of root files rather than embedding an expanding list in the implementation.
-
Add automated tests verifying that control files are not opened unless the corresponding opt-in option is enabled.