T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:50
- Finding
- Automatic Access to Persistent User Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 50–54 **Vulnerability Type**: Unnecessary access to persistent user data **Risk Level**: Medium **Complete Code Snippet**: ```md **Memory linkage** (read `memory/car.md` if it exists): - Known preferences: preferred powertrain (BEV/PHEV/EREV), budget range, deal-breakers - Known context: home city, commute distance, parking/charging situation - **Still confirm with the user** — memories may be stale or may belong to a previous context - If no `memory/car.md` exists, proceed normally. Don't invent preferences. ``` ### Technical Analysis The Skill directs the Agent to read `memory/car.md` whenever that file exists. This resource is outside the audited project and may contain persistent information from prior conversations, including the user's location, budget, commute, parking or charging situation, and purchasing preferences. Automatic access is broader than necessary for the vehicle-consultation task because the Skill already requires the Agent to ask the user for current requirements. The instruction acknowledges that the stored information may be stale or belong to a previous context, but reconfirming the data after reading it does not prevent the initial unauthorized access or accidental disclosure. No instruction to modify or poison memory was found, and no mechanism for transmitting memory contents to an external party was identified. The issue is therefore limited to unnecessary local access and possible cross-context disclosure. ### Attack Path 1. A user submits a vehicle-buying or comparison request that activates the Skill. 2. The Skill instructs the Agent to check whether `memory/car.md` exists. 3. If available, the Agent reads persistent information recorded in an earlier context. 4. Stale, misattributed, or private information influences the recommendation or is referenced while asking the user to confirm it. 5. Information from another context may consequently be exposed or impr ...[truncated 625 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unconditional instruction to inspect `memory/car.md`. 2. Collect current requirements directly from the user, as already required by the Skill workflow. 3. If memory use is optional, obtain explicit and informed user consent before accessing it. 4. Explain which stored fields will be read and why they are necessary. 5. Apply data minimization by retrieving only the specific fields required for the current request. 6. Validate that the memory belongs to the current user and conversation context. 7. Treat stored values as untrusted and potentially stale; never reveal them before the user independently supplies or explicitly authorizes their use. 8. Provide a memory-free execution path that offers equivalent core functionality. A safer replacement would be: ```md **Optional memory linkage**: - Do not access persistent memory by default. - Ask the user whether they want previously saved vehicle preferences to be used. - Only after explicit consent, retrieve the minimum fields necessary for this request. - Ask the user to confirm relevant values before using them in recommendations. ```