T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:41- Finding
Unprompted Sensitive Data Access and Persistent State Modification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:41-63
Vulnerability Type: Unauthorized monitoring and state-changing operations without explicit approval
Risk Level: MediumVulnerable Skill Instructions
The following is an English rendering of the complete relevant source segment:
markdown Periodically check the following and proactively contact the user when necessary: | Check item | Frequency | When to contact | |------------|-----------|-----------------| | Calendar | 2-4 times/day | An important meeting or event occurs within the next 2 hours | | Email | 2-4 times/day | An urgent or important email exists | | Stock price alerts | While the market is open | A price-change threshold is reached | | Weather | 1-2 times/day | Rain, lower temperatures, or another condition needs attention | ### When to remain quiet - Late at night, from 23:00 to 08:00, unless urgent - The user is obviously busy - A check was performed less than 30 minutes ago - There is no new information ## Proactive tasks that can be performed without asking - Organize memory files - Update documentation - Commit code changes - Clean temporary files - Check project statusTechnical Analysis
The skill directs the agent to access calendar and email information periodically, without requiring explicit opt-in for those sensitive data sources. It also expressly permits the agent to modify memory files and documentation, create repository commits, and delete files categorized as temporary without asking the user.
These instructions violate least-privilege and informed-authorization principles. The skill does not define authorized accounts, repositories, directories, file patterns, retention requirements, or operation-specific confirmation boundaries. It also does not require a preview, dry run, backup, or recoverable deletion mechanism.
The instruction does not independently bypass operating-system cont ...[truncated 1812 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user opt-in before accessing each sensitive integration, including calendar and email services.
- Define the authorized accounts, data fields, check frequency, retention policy, and notification conditions for every monitoring task.
- Remove the blanket authorization to perform state-changing operations “without asking.”
- Require explicit confirmation before modifying persistent memory, committing code, or deleting files.
- Restrict filesystem operations to user-approved directories and repository operations to explicitly selected repositories and branches.
- Present a dry-run summary or diff before documentation updates, memory changes, and commits.
- Use recoverable trash or quarantine instead of permanent deletion, and show the exact candidate file list before proceeding.
- Treat ambiguous files as non-temporary and exclude source files, configuration, credentials, user data, and untracked work from cleanup by default.
- Record an audit log containing the operation, affected resources, authorization decision, and result.
- Document that proactive behavior does not override normal access-control, consent, or confirmation requirements.