T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:129- Finding
Overbroad Access to Persistent User Context and Calendar Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:129-136andSKILL.md:174-179
Vulnerability Type: Excessive access to persistent user information
Risk Level: MediumVulnerable Code Snippets
From
SKILL.md:129-136:markdown ### 4. Memory/Context Files (if using ai-persona-os) **Locations:** - `MEMORY.md` — Permanent facts - `memory/[today].md` — Session notes - `USER.md` — User preferencesFrom
SKILL.md:174-179:markdown Check for these files in order: 1. todo.md (to-do list from ai-meeting-notes) 2. meeting-notes/ folder (recent meeting notes) 3. MEMORY.md (if using ai-persona-os) 4. memory/[today].md (session notes) 5. Calendar integration (if available)Technical Analysis
The skill instructs the agent to inspect persistent memory, daily session notes, user-profile data, meeting notes, and available calendar information whenever it generates a briefing. These sources can contain personal, confidential, or unrelated information beyond what is strictly necessary to summarize current tasks.
Although access to some sources is conditional on their availability, the skill does not require explicit user consent before reading them. It also defines no field-level filtering, path restrictions for meeting notes, sensitivity classification, secret redaction, or data-minimization rules. Consequently, the briefing workflow may use all information that the host agent is permitted to read rather than only the information required for the current request.
This violates the principle of least privilege at the skill-instruction level. The skill does not independently bypass operating-system permissions, but it can cause an already privileged host agent to exercise broader read access than the user would reasonably expect from a routine daily briefing request.
Attack Path
- The user invokes a broad trigger phrase such as
briefing,start my day, orgive me the rundown. - The agent follows the mandatory data-gatheri ...[truncated 1381 chars]
- The user invokes a broad trigger phrase such as
- Remediation
View remediation
Remediation Suggestions
-
Require explicit source consent
- Ask the user before accessing persistent memory, user-profile files, or calendar data.
- Store source permissions as opt-in preferences rather than enabling every available source automatically.
- Allow separate controls for tasks, meetings, persistent memory, profile data, and calendar data.
-
Use least-privilege defaults
- Default to
todo.mdand explicitly selected recent meeting notes. - Disable access to
MEMORY.md,USER.md, and calendar integrations unless the user enables them. - Limit meeting-note access to a designated workspace directory and the documented three-to-seven-day window.
- Default to
-
Apply data minimization
- Read only fields needed for the requested briefing date.
- Extract task titles, deadlines, and event times without ingesting unrelated profile or session content.
- Avoid displaying attendee details, private descriptions, permanent personal facts, or historical notes unless directly relevant and requested.
-
Add sensitivity filtering
- Exclude credentials, API keys, authentication tokens, financial information, medical information, and other secrets.
- Redact sensitive event names and meeting content by default.
- Require confirmation before presenting potentially private information.
-
Make source usage transparent
- Identify which sources were consulted.
- Allow the user to request a briefing from a restricted source set, such as “tasks only” or “calendar only.”
- Provide a configuration option that permanently disables persistent-memory access.
-
Harden the instructions
- Replace the unconditional gathering sequence with a consent-aware workflow.
- Add a rule stating that availability of a data source does not itself authorize access.
- Require the agent to avoid reading unrelated files even when its runtime permissions permit doing so.
-