T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:88
- Finding
- Automatic Cross-Tool Collection of Sensitive Conversation Histories<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:88-176` **Vulnerability Type**: Automatic access to private conversation histories without per-source consent or data minimization **Risk Level**: Medium ### Vulnerable Code ```python def extract_claude_code_prompts(limit=100): """提取 Claude Code 用户提示词""" history_file = Path.home() / ".claude" / "history.jsonl" prompts = [] if history_file.exists(): with open(history_file, 'r') as f: for line in f: try: data = json.loads(line) if data.get('display'): prompts.append(data['display']) except: continue return prompts[-limit:] if prompts else [] def extract_codex_prompts(limit=100): """提取 Codex 用户提示词""" history_file = Path.home() / ".codex" / "history.jsonl" prompts = [] if history_file.exists(): with open(history_file, 'r') as f: for line in f: try: data = json.loads(line) if data.get('text'): prompts.append(data['text']) except: continue return prompts[-limit:] if prompts else [] def extract_gemini_prompts(limit=100): """提取 Gemini 用户提示词""" gemini_dir = Path.home() / ".gemini" / "tmp" prompts = [] if gemini_dir.exists(): for session_file in gemini_dir.rglob("session-*.json"): try: with open(session_file, 'r') as f: data = json.load(f) messages = data.get('messages', []) for msg in messages: if msg.get('role') == 'user': content = msg.get('content', '') if content: prompts.append(content) except: continue return prompts[-limit:] if prompt ...[truncated 4178 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit confirmation before accessing any history files. 2. Present each supported data source separately and default all sources to disabled. 3. Display the resolved file paths and estimated record counts before reading content. 4. Allow users to select a specific tool, session, file, and date range. 5. Avoid recursive directory enumeration unless the user explicitly authorizes it. 6. Process only the minimum features needed for analysis, such as local length and keyword counts, rather than retaining complete prompt text. 7. Add local secret and personal-data redaction before aggregation. 8. Clear raw prompts from memory as soon as derived metrics are calculated. 9. Document the local processing trust boundary and all files that may be accessed. 10. Fail closed on malformed files and log only paths or counts, never raw prompt content. ]]>