T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:34
- Finding
- Undisclosed Transmission of Context-Derived User and Project Information<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-38`, `SKILL.md:65-72`, and `SKILL.md:159-166` **Vulnerability Type**: Excessive access to local context followed by external data transmission **Risk Level**: Medium ### Vulnerable Code `SKILL.md:34-38`: ```markdown Claude Code infers search intent from available context: - User's current project / tech stack - Memory (skills, interests, goals) - Recent conversation topics - CLAUDE.md / package.json / repo signals ``` `SKILL.md:65-72`: ```bash # Primary search curl -s "https://www.aicoo.io/api/square?q=<TERMS>&limit=10&sort=most_asked" | jq . # Broaden if sparse (try different angle) curl -s "https://www.aicoo.io/api/square?subsquare=builders&sort=most_asked&limit=10" | jq . ``` `SKILL.md:159-166`: ```markdown When inferring what to search for, consider (in priority order): 1. **Explicit memory** — user's skills, interests, goals from memory system 2. **Current project** — tech stack from package.json, Cargo.toml, etc. 3. **Conversation** — what they've been working on or talking about 4. **Subsquare affinity** — if user is a builder, start with `builders`; if job hunting, `hiring` Combine signals into 2-3 diverse searches. Don't over-optimize for one angle — surprise is part of discovery. ``` ### Technical Analysis The Skill's declared purpose is to discover people through a public Aicoo Square search. However, its default Auto Mode instructs the Agent to inspect multiple sources of potentially private context, including: - Persistent user memory - Recent conversation content - Local project manifests - `CLAUDE.md` repository instructions - User interests, goals, and employment-related context The Agent is then instructed to derive search terms from this information and include them in requests to `https://www.aicoo.io`. This creates an external disclosure channel for information obtained from local or session-scoped sources. The access exceeds the minimum privileges required for ...[truncated 2867 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Use minimum-context discovery by default** - For generic discovery requests, browse public popular or recent Square entries. - Do not access persistent memory, conversation history, or repository files unless the user explicitly enables context-aware discovery. 2. **Require informed consent** - Before reading contextual sources, clearly state which sources will be inspected. - Before making the request, show the proposed search terms and obtain confirmation that they may be sent to Aicoo. - Keep approval limited to the current request rather than treating it as permanent consent. 3. **Restrict local file access** - Do not read `CLAUDE.md` or arbitrary repository files for discovery. - If project-aware searching is explicitly requested, use an allowlist of low-sensitivity manifest fields. - Exclude package scopes, private package names, repository URLs, author details, organization names, and environment-specific configuration. 4. **Apply sensitivity filtering** - Reject or redact credentials, tokens, email addresses, internal hostnames, customer names, unreleased project identifiers, filesystem paths, and other unique identifiers. - Prefer broad categories such as `TypeScript`, `Rust`, or `machine learning` rather than copying raw contextual text. 5. **Prefer user-provided search intent** - Ask the user for optional interests or search terms when the available context may be sensitive. - Allow generic results to be returned immediately without requiring contextual inspection. 6. **Minimize URL exposure** - If the API supports it, submit search terms through a POST body rather than a URL query string. - Regardless of transport, send only the minimum generalized terms required, because POST bodies may also be logged. 7. **Document the data flow** - State that derived search terms are transmitted to `www.aicoo.io`. - Identify the contextual data sources, purpose, destinatio ...[truncated 113 chars]