T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- skill.yml:45
- Finding
- Excessive access to agent memory and overprivileged GitHub credentials<![CDATA[ ## Vulnerability Details **File Location**: `skill.yml:45-48`; related credential guidance at `SKILL.md:858-860` **Vulnerability Type**: Least-privilege violation **Risk Level**: High ### Vulnerable Code Snippet ```yaml permissions: file_access: read: ["workspace/candidates/**", "workspace/memory/*.md"] write: ["workspace/candidates/*/profile.md", "workspace/candidates/*/recommendation.md"] ``` Related GitHub authentication guidance: ```bash # Method 1: GitHub Personal Access Token # Generate a token with the recommended scopes: repo, read:user export GITHUB_TOKEN="your_personal_access_token" # Method 2: GitHub CLI login gh auth login ``` The comments above are faithful English renderings of the source instructions. ### Technical Analysis The Skill requests read access to `workspace/memory/*.md`, although its declared purpose is candidate screening, recommendation writing, outreach generation, interview assessment, client management, and talent mapping. General agent memory is not necessary to perform those tasks. The Skill also recommends a GitHub personal access token with `repo` and `read:user` scopes. The classic `repo` scope can expose private repositories and grants substantially broader repository access than is needed to search public repositories or inspect public contributor activity. The combination is particularly risky because the Skill also recommends multiple GitHub helper Skills. A compromised or overly broad helper could inherit the exported token and use it to access private repositories. ### Attack Path 1. A user enables the Skill with the permissions declared in `skill.yml`. 2. The Skill or a dependency reads unrelated persistent state from `workspace/memory/*.md`. 3. The user follows the GitHub setup instructions and exports a token with `repo` scope. 4. A GitHub helper process inherits `GITHUB_TOKEN`. 5. The helper uses the token to enumerate or read private repositories beyond the recruitment task’s legitim ...[truncated 699 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `workspace/memory/*.md` from the Skill’s read permissions. 2. Restrict file access to the specific candidate records supplied for the current task. 3. Use a fine-grained GitHub token limited to explicitly selected repositories. 4. Grant only read-only metadata or content permissions required for a defined workflow. 5. Do not request the classic `repo` scope for public contributor searches. 6. Avoid exporting credentials into a general shell environment. Pass credentials only to the specific trusted process that requires them. 7. Document credential lifetime, revocation, rotation, and storage requirements. 8. Prevent third-party helper Skills from automatically inheriting GitHub credentials unless separately approved. ]]>