T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:25
- Finding
- Overbroad Local Record Access and Potential Disclosure Through Citations## Vulnerability Details **File Location**: `SKILL.md`, lines 25–33 **Vulnerability Type**: Overbroad access to persistent Agent memory and local records **Risk Level**: Medium **Vulnerable Code:** ```markdown ### Core Rule > Before making any factual claim, check if it's recorded in files (MEMORY.md, docs, knowledge base, etc.). > If no record exists → say "I couldn't find a record of that" or "I'm not sure." > Never fabricate details or present speculation as fact. ### Self-Check Flow (Automatic, Every Round) ``` 1. ✋ PAUSE — Before speaking, stop and think 2. 📂 CHECK — Does the information have file/record support? → YES: Cite the source (path + line if possible) ``` ### Technical Analysis The Skill directs the Agent to inspect broadly defined local records, explicitly including persistent `MEMORY.md` content, before making factual claims. It provides no file allowlist, task-specific scope boundary, user-consent requirement, sensitivity classification, or redaction policy. The instruction to cite a source path and line where possible compounds the risk: an answer may reveal both sensitive record content and details of the local filesystem structure. The behavior therefore violates least-privilege principles because hallucination prevention does not inherently require unrestricted access to all persistent memory, documents, or knowledge-base files. No executable code, automated network transmission, privilege-elevation mechanism, or external exfiltration channel was identified. Exploitation depends on the hosting Agent having access to sensitive local records and honoring these instructions. ### Attack Path 1. Sensitive information is stored in `MEMORY.md`, a document, or a local knowledge-base file accessible to the Agent. 2. A user submits a factual question related to that information. 3. Following the Skill's automatic per-response workflow, the Agent searches available local records. 4. The Age ...[truncated 753 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict source checks to files explicitly supplied or approved by the user for the current task. 2. Introduce a configurable allowlist of permitted document roots and reject access outside those roots. 3. Require explicit user consent before inspecting persistent memory such as `MEMORY.md`. 4. Apply data classification and redaction before incorporating record content into responses. 5. Never reproduce credentials, authentication tokens, personal data, or confidential business records. 6. Cite logical document identifiers rather than absolute or sensitive filesystem paths. 7. Limit quoted material to the minimum necessary evidence and verify that the requester is authorized to receive it. 8. Define deny rules for secrets files, private memory, environment files, key stores, and unrelated documents.