T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:44- Finding
AI-Agent Auto-Login Uses Stored Credentials and Persists an Authenticated Session
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 44–51 and 61–62
Vulnerability Type: Automated use of stored credentials without a documented per-login authorization boundary
Risk Level: MediumThe skill explicitly instructs AI agents to authenticate to the Blackboard teaching platform using credentials obtained from the operating-system keyring or environment. It also states that the authenticated session is persisted in the user's home directory.
markdown ## Auto-Login for AI Agents ```bash # Check session status info-auth check # Auto-login (reads credentials from OS keyring, no password needed) course login -ptext ```markdown - Session persisted to `~/.config/info/course/` - Credentials resolved via `info_common::credential` (keyring → env → interactive)Technical Analysis
The documented workflow gives an AI agent access to an authentication mechanism backed by stored user credentials. No password entry is required, and the skill does not require explicit user confirmation immediately before retrieving credentials or establishing the authenticated session.
This creates a least-privilege concern because tasks such as source-code debugging, HTML parser maintenance, or CLI feature development do not necessarily require access to the user's live teaching-platform account. Once authenticated, the documented CLI supports access to private courses, assignments, files, announcements, and recordings. It also supports state-changing operations such as assignment submission and TOTP management.
The environment-variable fallback further increases exposure because environment variables may be inherited by child processes or become accessible through debugging and process-inspection workflows. Session persistence can extend authenticated access beyond the command that established it. The reviewed file does not document session expiry, file permissions, command-speci ...[truncated 1863 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic login as the default workflow for AI agents.
- Require explicit, informed user confirmation immediately before accessing the keyring, reading credential-bearing environment variables, or initiating authentication.
- Clearly distinguish offline development tasks from operations requiring a live account, and use fixtures or sanitized HTML samples for parser development and testing.
- Require a separate confirmation immediately before state-changing operations, especially assignment submission and TOTP management.
- Use short-lived, narrowly scoped sessions where the platform permits them, and document session expiry and revocation behavior.
- Store session material with restrictive owner-only filesystem permissions and reject session files with unsafe ownership or permissions.
- Avoid environment-variable credential fallback where practical. If retained, document the exposure risks and prevent credentials from appearing in logs, diagnostics, command output, or child-process environments.
- Provide a logout or session-revocation step at the end of agent-driven workflows.
- Display the target account and intended operation before authentication so the user can verify the authorization scope.
- Add audit logging for authentication and sensitive account operations without recording passwords, TOTP seeds, session cookies, or other secrets.