T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:109- Finding
Overbroad Access to Session History for Cost Estimation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 109-111
Vulnerability Type: Excessive access to sensitive session data
Risk Level: MediumRelevant workflow, rendered in English:
text If historical data is required: 1. Query `sessions_list` to obtain the recent session list. 2. Invoke `sessions_history` for every session to estimate usage.Technical Analysis
The documented workflow instructs the Agent to enumerate recent sessions and invoke
sessions_historyfor each one. Session history can contain prompts, responses, operational instructions, customer information, and other sensitive conversation content. Cost analysis ordinarily requires only model identifiers, token counts, and billing metadata.Accessing complete histories for every session therefore violates least-privilege and data-minimization principles when equivalent usage metadata is available through
session_status,sessions_list, provider billing information, or a dedicated usage interface. The Python scripts do not directly perform this access; the exposure originates from the instructions that govern Agent tool usage.Attack Path
- A user requests historical cost analysis.
- The Agent loads and follows the workflow in
SKILL.md. - The Agent invokes
sessions_listto enumerate recent sessions. - The Agent invokes
sessions_historyfor each enumerated session. - Conversation content unrelated to billing becomes available in the Agent's active context.
- That content may subsequently be summarized, logged, included in a report, or exposed through an erroneous response.
Exploitation is limited by the permissions of the session tools. The workflow does not independently bypass access controls, but it encourages use of all history that the Agent is already authorized to retrieve rather than requesting only the minimum billing metadata.
Impact Assessment
The Agent may obtain read access to conf ...[truncated 370 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to retrieve complete session histories for routine cost analysis.
- Use
session_status, session-list usage metadata, provider billing exports, or a dedicated usage API that returns only model, token, cost, agent, and timestamp fields. - If history access is unavoidable, require explicit user authorization before retrieval.
- Restrict retrieval to user-selected sessions and the smallest necessary time range.
- Extract only usage metadata and prevent message bodies from entering reports, logs, or temporary files.
- Add an explicit prohibition against collecting prompts and responses for billing calculations.
- Apply access controls so that an Agent can inspect only sessions belonging to the requesting user or authorized billing scope.