T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
init.py:40- Finding
Initialization Collects Agent Memory and User Profile Data Without Explicit Consent
- Content
View full analysis
Vulnerability Details
File Location:
init.py:40-98
Vulnerability Type: Excessive access to identity, long-term memory, and recent conversation-memory files
Risk Level: MediumRelevant Code:
python def extract_user_info(): """Extract user information from environment files.""" info = { "name": None, "institution": None, "research_focus": [], "current_projects": [] } # 1. Attempt extraction from USER.md user_md = _slurp(os.path.join(WORKSPACE_DIR, "USER.md")) if user_md: m = re.search(r'[Nn]ame[:：\s*]+(?:\*\*)?(\S+?)(?:\*\*)?(?:\s|$)', user_md) if m: raw_name = m.group(1).strip().strip('*') info["name"] = re.split(r'[（(]', raw_name)[0].strip() inst_patterns = [ r'(?:公司|机构|institution|org)[:：\s]+(\S+)', r'(?:就职于|在|at)\s+([\u4e00-\u9fa5A-Za-z]+)', r'Huawei|腾讯|字节|阿里|百度|Google|Meta|OpenAI|Microsoft|Amazon|Apple|DeepSeek' ] for pat in inst_patterns: m = re.search(pat, user_md) if m: info["institution"] = m.group(0) if m.lastindex is None else m.group(1) break # 2. Attempt extraction of research interests from MEMORY.md memory_md = _slurp(os.path.join(WORKSPACE_DIR, "MEMORY.md")) if memory_md: tech_signals = [ ("credit assignment", "credit assignment"), ("agentic RL", "agentic RL"), ("agentic reinforcement learning", "agentic RL"), ("multi-scale", "multi-scale RL"), ("hierarchical RL", "hierarchical RL"), ("policy optimization", "policy optimization"), ("reward model", "reward modeling"), ("reinforcement learning", "reinforcement learning"), ] for keyword, label in tech_signals: if keyword.lower() in mem ...[truncated 3057 chars]- Remediation
View remediation
Remediation Suggestions
- Remove automatic reads of
USER.md,MEMORY.md, and thememorydirectory from the default initialization path. - Ask the user directly for the minimum required input: research topics and optional keywords.
- If profile import is retained, make it an explicit opt-in command such as
--import-profile. - Before import, list every file that will be read and every field that will be persisted.
- Allow users to approve identity, institution, research interests, and projects independently.
- Parse only a user-selected file rather than scanning recent conversation-memory files.
- Avoid persisting identity and institution unless they are demonstrably required.
- Add tests confirming that ordinary initialization performs no access outside the Skill directory.
- Document retention and deletion procedures for profile information written to
config.json.
- Remove automatic reads of