T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Overbroad Access to Archived Conversation History## Vulnerability Details **File Location**: `SKILL.md:11-28`, `SKILL.md:32-48`, `MCP-TOOLS.md:5-14`, and `MCP-TOOLS.md:82-112` **Vulnerability Type**: Excessive access to stored conversation data **Risk Level**: Medium ### Vulnerable Code `SKILL.md:11-28` ```markdown ## Mandatory: Use the Search Agent **YOU MUST dispatch the search-conversations agent for any historical search.** Announce: "Dispatching search agent to find [topic]." Then use the Task tool with `subagent_type: "search-conversations"`: ``` Task tool: description: "Search past conversations for [topic]" prompt: "Search for [specific query or topic]. Focus on [what you're looking for - e.g., decisions, patterns, gotchas, code examples]." subagent_type: "search-conversations" ``` The agent will: 1. Search with the `search` tool 2. Read top 2-5 results with the `show` tool 3. Synthesize findings (200-1000 words) 4. Return actionable insights + sources ``` `SKILL.md:32-48` ```markdown ## When to Use You often get value out of consulting your episodic memory once you understand what you're being asked. Search memory in these situations: **After understanding the task:** - User asks "how should I..." or "what's the best approach..." - You've explored current codebase and need to make architectural decisions - User asks for implementation approach after describing what they want **When you're stuck:** - You've investigated a problem and can't find the solution - Facing a complex problem without obvious solution in current code - Need to follow an unfamiliar workflow or process **When historical signals are present:** - User says "last time", "before", "we discussed", "you implemented" - User asks "why did we...", "what was the reason..." - User says "do you remember...", "what do we know about..." ``` `MCP-TOOLS.md:82-112` ```markdown ## read Display a full conv ...[truncated 3523 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user consent before every search of archived conversations. 2. Limit searches to the authenticated user and current project by default. 3. Replace broad triggers such as ordinary architectural questions with explicit requests to consult conversation history. 4. Return result metadata and minimal snippets first rather than immediately reading multiple conversations. 5. Require a second authorization decision before reading a complete conversation. 6. Use `startLine` and `endLine` to retrieve only the lines necessary for the current task. 7. Apply automatic redaction for credentials, API tokens, personal data, and unrelated proprietary content. 8. Enforce access controls in the episodic-memory service rather than relying exclusively on Skill instructions. 9. Record archive searches and reads in an audit log containing the requesting user, project scope, query, accessed records, and justification. 10. Prevent retrieved content from being reproduced verbatim unless it is necessary, authorized, and relevant to the current request.