T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:23
- Finding
- Overbroad Inspection and Reporting of Sensitive Agent State## Vulnerability Details **File Location**: `SKILL.md`, lines 23-31 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium ### Relevant Source Excerpt The following is an English translation of the relevant documentation: ```markdown ### 2. Memory Usage - Memory file size - Most recently updated files - Whether important information has been omitted ### 3. Sub-Agent Activity - Number of currently running sub-Agents - Recently completed tasks - Whether any tasks are stuck ``` Additional monitoring of installed capabilities is specified at `SKILL.md`, lines 38-41: ```markdown ### 5. Capability Tree Status - Number of skills - Newly added skills - Skill health status (whether they can be loaded) ``` ### Technical Analysis The Skill directs the Agent to inspect memory files, recent tasks, sub-Agent activity, and installed skills. These sources may contain sensitive operational state, user context, task payloads, internal paths, identifiers, or details about available capabilities. In particular, determining whether “important information has been omitted” is not limited to collecting health metrics. It may require reading and interpreting memory contents. Likewise, reporting recently completed or stuck tasks may expose task details rather than aggregate availability information. This exceeds the least privilege required for a basic health monitor, which would ordinarily need only non-content metrics such as counts, timestamps, status codes, and durations. The package contains no executable scripts, so it does not itself implement a permission bypass or remote exfiltration channel. The risk arises when a capable Agent follows these instructions using its existing access to memory, task records, and skill inventories. ### Attack Path 1. The Agent loads the `self-health-monitor` Skill. 2. The documented workflow schedules monitoring every 30 minutes, as speci ...[truncated 1382 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict monitoring to aggregate, non-content metrics, such as file counts, total storage usage, timestamps, task counts, status codes, and response durations. 2. Explicitly prohibit reading memory contents or task payloads as part of routine health checks. 3. Remove or narrowly redefine the requirement to determine whether important information has been omitted. 4. Require explicit authorization before inspecting task history, memory contents, or installed capability inventories. 5. Apply least-privilege access controls so the monitor can access only dedicated health telemetry interfaces. 6. Redact file paths, task descriptions, user content, Agent identifiers, and skill names from reports unless specifically required. 7. Define approved report recipients and prevent proactive alerts from being sent to untrusted channels. 8. Establish retention limits and access controls for generated reports and monitoring logs. 9. Document failure behavior so unavailable metrics are reported as unavailable rather than triggering broader filesystem or state inspection.