T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- skill.yml:47
- Finding
- Overbroad Access to Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `skill.yml:47-50` **Vulnerability Type**: Violation of least privilege through unnecessary persistent-memory access **Risk Level**: Medium ### Vulnerable Code ```yaml # Permission boundaries permissions: file_access: read: ["workspace/candidates/**", "workspace/memory/*.md"] write: ["workspace/candidates/*/profile.md", "workspace/candidates/*/recommendation.md"] ``` ### Technical Analysis The Skill requests read access to every Markdown file under `workspace/memory/`. Its declared functions—candidate screening, recommendation writing, outreach generation, interview assessment, client management, and talent mapping—do not require access to general persistent Agent memory. The operational prompt does not define a memory-dependent workflow either. This permission therefore exceeds the Skill's legitimate functional requirements. If the hosting Agent enforces the declared paths by exposing matching files to the Skill, candidate data or other user-controlled task content could cause the model to retrieve persistent information unrelated to the current recruitment task. Although no instruction was found that explicitly exfiltrates memory contents, the permission itself expands the accessible data boundary and creates an avoidable confidentiality risk. ### Attack Path 1. A user or untrusted recruitment document invokes the Skill for a supported task. 2. The runtime grants the file permissions declared in `skill.yml`. 3. The Skill receives read access to all `workspace/memory/*.md` files. 4. Task content induces or requests retrieval of information from those files. 5. The retrieved persistent context may be incorporated into the current analysis or response. 6. Information from unrelated sessions can consequently be disclosed to the current user or mixed into candidate records. This path depends on the host runtime honoring the manifest permission and allowing the model to initiate reads within t ...[truncated 598 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the general memory path from the read allowlist: ```yaml permissions: file_access: read: ["workspace/candidates/**"] write: - "workspace/candidates/*/profile.md" - "workspace/candidates/*/recommendation.md" ``` 2. If durable recruitment state is genuinely required, create a dedicated, narrowly scoped directory such as `workspace/headhunter-pro/state/**`. 3. Restrict access by candidate or task identifier rather than exposing an entire shared state directory. 4. Require explicit user approval before reading information from a previous task or session. 5. Ensure the runtime resolves paths canonically and rejects path traversal, symlink escapes, and wildcard expansion outside the approved recruitment workspace. 6. Add tests confirming that the Skill cannot read general Agent memory or records belonging to unrelated tasks. ]]>