T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/session-wrap-up.sh:35
- Finding
- Automatic Commit and Push Can Expose Sensitive Workspace Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/session-wrap-up.sh`, lines 35-47 **Vulnerability Type**: Automatic disclosure of sensitive and unrelated repository content **Risk Level**: High ### Vulnerable Code ```bash # Only commit text/config files, skip binaries and media if git rev-parse --git-dir >/dev/null 2>&1; then # Add only text/config files git add *.md *.txt *.json *.sh *.yaml *.yml *.env 2>/dev/null || true git add docs/* scripts/* skills/* memory/* 2>/dev/null || true git add AGENTS.md USER.md SOUL.md MEMORY.md TOOLS.md 2>/dev/null || true git add projects/*/README.md projects/*/notes/* 2>/dev/null || true if [[ -n "$(git status --porcelain 2>/dev/null)" ]]; then echo "Committing text/config changes..." git commit -m "Auto-wrap-up: $(date -Iseconds)" 2>/dev/null || true if git remote get-url origin >/dev/null 2>&1; then git push origin HEAD 2>/dev/null && echo " ✓ Pushed to origin" || echo " ⚠ Push failed" fi ``` ### Technical Analysis The script indiscriminately stages broad classes of workspace files, including `.env` files, memory records, user-related files, agent instruction files, and tool configuration. These file categories are particularly likely to contain API keys, personal information, internal project details, or privileged agent state. The subsequent `git commit` does not limit the commit to files staged by this invocation. Any content already in the Git index is also included. The resulting commit is automatically pushed to the repository configured as `origin`, without validating whether the destination is trusted, private, or expected and without presenting the staged diff for user approval. Although shipping work is part of the declared functionality, automatically transmitting sensitive agent and environment files exceeds the minimum privileges necessary to commit ordinary work products. ### Attack Path 1. A secret, private memory entry, or sensitive instruction is s ...[truncated 1224 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never automatically stage `.env` files, secrets, memory records, identity files, or agent-control files. - Replace broad glob patterns with a narrowly defined allowlist of expected work-product paths. - Detect a nonempty Git index before staging and abort rather than including pre-existing staged changes. - Use `git diff --cached --name-only` and secret scanning to inspect the exact proposed commit. - Display the staged diff and require explicit user confirmation before committing. - Validate the remote URL against a configured allowlist and require separate confirmation before pushing. - Do not suppress commit and push errors, because hidden failures can make the reported state inaccurate. - Add sensitive paths to `.gitignore`, while recognizing that `.gitignore` does not protect files already tracked. - If secrets have already been pushed, rotate them immediately and remove them from repository history using an appropriate history-rewriting process. ]]>