T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:38
- Finding
- Overbroad Collection of Local Project, Task, Identity, and Configuration Data## Vulnerability Details **File Location**: `SKILL.md`, lines 38–55 and 200–206 **Vulnerability Type**: Excessive local data access and insufficient scope restriction **Risk Level**: Medium ### Vulnerable Code `SKILL.md`, lines 38–55: ```markdown **Project commit history:** - Use appropriate system tool to read commit log for the specified date range - Collect: commit message, timestamp, project name - Include all branches the user contributed to **Change statistics:** - Collect number of files changed, lines added/removed - Group by project if multiple repos **Task completion:** - If todoist CLI is available, query completed tasks for the date - Otherwise, skip this source ### Multi-Project Handling If the user has multiple projects: 1. Scan for project directories in common locations (workspace, home, desktop) 2. Collect activity from each 3. Group results by project in the output ``` `SKILL.md`, lines 200–206: ```markdown | User provides manual input | Combine manual descriptions with any available stats | | Multiple contributors detected | Filter to only the user's commits (by author name/email) | | Very active day (20+ commits) | Group aggressively, focus on features/fixes, collapse minor commits into stats | | Across time zones | Use the user's local date (from USER.md timezone setting) | ``` ### Technical Analysis The Skill instructs the Agent to scan broad filesystem locations, including the user's home and desktop directories, instead of limiting collection to repositories explicitly selected for the report. It also directs the Agent to inspect all contributed branches, query Todoist data, derive identity from author names or email addresses, and read timezone information from `USER.md`. These operations may be performed merely because the user requested a work report. The instructions do not require separate informed consent for each data source, define an allowed repository ro ...[truncated 2409 chars]
- Remediation
- ## Remediation Suggestions 1. Default collection to the current working repository or a repository path explicitly supplied by the user. 2. Require explicit confirmation before searching additional directories, accessing task managers, reading calendars, or consulting user-profile files. 3. Replace automatic scanning of home and desktop directories with a user-provided allowlist of repository roots. 4. Apply strict search boundaries, including maximum directory depth, repository count, and excluded paths. 5. Do not read `USER.md` solely to determine timezone. Ask the user for the relevant timezone or use a non-sensitive runtime setting with their consent. 6. Ask the user to provide the Git author identity to filter, rather than automatically collecting names and email addresses from repository history. 7. Limit Git inspection to the requested date range, selected branches, and selected repositories. 8. Make Todoist and calendar access opt-in and clearly state what fields will be collected before invoking those integrations. 9. Redact email addresses, private repository names, task descriptions, and other sensitive metadata unless the user explicitly requests their inclusion. 10. Present a data-source preview before collection, for example: “Use the current repository only,” “Add selected repositories,” or “Include task and calendar data.”