T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:27
- Finding
- Unconsented Persistent-Memory Access and Location Disclosure## Vulnerability Details **File Location**: `SKILL.md`, lines 27-30 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ```markdown - If no location is mentioned at all → infer the user's location from conversation history or MEMORY.md ### Step 2: Retrieve Weather Data - Use `wttr.in` to query real-time weather: `https://wttr.in/{city}?format=j1` ``` The excerpt above is an English translation of the relevant instructions. ### Technical Analysis The Skill instructs the Agent to inspect conversation history or persistent `MEMORY.md` data when the user has not supplied a location. This violates least-privilege principles because persistent memory may contain personal information unrelated to the immediate weather request. The required functionality can instead be completed by asking the user to provide or confirm a city. After inferring a city, the Skill directs the Agent to place it in a request to the third-party `wttr.in` service. This creates an external disclosure path for location information obtained from persistent state without an explicit confirmation or consent step. The issue does not grant arbitrary filesystem access, code execution, or elevated operating-system privileges. Its scope is limited to unauthorized use of memory available to the Agent and disclosure of an inferred location to an external weather provider. ### Attack Path 1. A user asks an ambiguous question such as “What is the weather here?” without specifying a location. 2. The Skill directs the Agent to inspect conversation history or `MEMORY.md`. 3. The Agent finds location-related personal information stored during a previous interaction. 4. The Agent infers a city without asking the user to confirm it. 5. The city is inserted into `https://wttr.in/{city}?format=j1`. 6. The external service receives the inferred location as part of the HTTP request. No attacker-controlled code execution is required. Exploitation occurs through r ...[truncated 752 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to infer location from `MEMORY.md` by default. 2. When no location is supplied, ask the user to provide or confirm a city before making an external request. 3. Permit persistent-memory lookup only after explicit, informed opt-in and only when the stored location was collected for this purpose. 4. Inform the user that the confirmed city will be sent to `wttr.in` to retrieve weather data. 5. Minimize transmitted location precision. Use a city or broad region rather than a street address, neighborhood, or exact coordinates. 6. Validate and URL-encode the confirmed city before constructing the request. 7. Provide a privacy-preserving fallback, such as instructions for consulting an official local weather source, when the user declines external disclosure. 8. Document the external service, the data transmitted, and any applicable retention or privacy considerations.