T05 · Unauthorized Access and Privilege Escalation
- Location
reference/patterns/facing-layoff.md:39- Finding
Instructions Encourage Unauthorized Export of Employer and Client Data
- Content
View full analysis
Vulnerability Details
File Location:
reference/patterns/facing-layoff.md, lines 39 and 142-150
Vulnerability Type: Instructions that may facilitate unauthorized retention and disclosure of confidential data
Risk Level: MediumVulnerable Content
markdown - **Evidence gathering**: Save project docs, performance reviews, work samples (before you lose access)markdown **Hour 2-24 (Before losing access):** - [ ] Download personal files, contacts, calendar - [ ] Save evidence of your work (projects, metrics, presentations) - [ ] Update LinkedIn with current role details - [ ] Forward important emails to personal account (check company policy) - [ ] Export contact list of colleagues/clientsTechnical Analysis
The layoff workflow instructs users to copy project documents, work samples, presentations, emails, calendars, and colleague or client contact lists before organizational access is revoked. These materials may contain employer intellectual property, trade secrets, internal communications, personal data, or information protected by contractual confidentiality obligations.
The timing language—“before you lose access”—creates an incentive to use currently valid access to retain information outside the employer-controlled environment. Only the email-forwarding instruction mentions checking company policy. The other instructions do not require ownership verification, explicit authorization, data minimization, redaction, or use of an approved export process.
This is not direct technical privilege escalation by the Skill because the package contains no executable code and does not obtain system permissions itself. Nevertheless, the instructions may facilitate circumvention of organizational access-control objectives by helping a departing employee retain data that would become inaccessible after offboarding.
Attack Path
- A user learns that employment access will soon be revoked.
- The user invokes the Skill for layo ...[truncated 1257 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the affected guidance with a least-privilege, authorization-based process:
- Permit export only of documents that are demonstrably personal and that the user is authorized to retain.
- Explicitly prohibit copying source code, internal project files, business metrics, client lists, confidential email, trade secrets, credentials, and personal data.
- Direct users to request approved copies of performance reviews, employment records, compensation documents, and reference letters from HR or Legal.
- Require compliance with employment agreements, confidentiality obligations, privacy requirements, litigation holds, and organizational data-handling policies.
- Recommend using employer-approved export channels rather than personal email, cloud storage, or removable media.
- For portfolio materials, require written permission and removal of company names, client identities, internal metrics, proprietary designs, and other sensitive details.
- Advise users to consult HR, Legal, or an authorized manager when ownership or export rights are uncertain.
A safer replacement would be:
markdown - Preserve only personal employment records and portfolio materials that you are explicitly authorized to retain. - Do not copy internal project files, source code, confidential emails, client or colleague lists, trade secrets, or personal data. - Request approved copies of performance reviews and employment records from HR. - Obtain written permission and redact sensitive information before using work samples in a portfolio.