T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- CLAUDE.md:152
- Finding
- Project Instructions Direct the Agent to Private Credential Memory<![CDATA[ ## Vulnerability Details **File Location**: `CLAUDE.md:152` **Vulnerability Type**: Least-privilege violation through access to private credential storage **Risk Level**: High ### Vulnerable Code ```markdown **发布凭据**：见 `~/CLAUDE.md` §2 或 `~/.claude/projects/-Users-jobzhao/memory/publish_credentials.md`。 ``` English translation: “For publishing credentials, see section 2 of `~/CLAUDE.md` or `~/.claude/projects/-Users-jobzhao/memory/publish_credentials.md`.” ### Technical Analysis The project-level agent instructions explicitly direct the agent to read credentials from files outside the project directory. One location is a global agent instruction file, while the other is a persistent agent-memory file containing publishing credentials. Access to these files is not required for the Skill’s declared content-writing, analysis, or coaching functions. The instruction therefore crosses the minimum-permission boundary and creates a path through which a project can cause an agent to inspect or use unrelated private state. The referenced development workflow also includes repository pushes and Skill publication. Consequently, an agent following the instructions could retrieve reusable publication credentials and use them for operations beyond ordinary content assistance. ### Attack Path 1. An agent loads the project and treats `CLAUDE.md` as project instructions. 2. The agent is asked to perform or troubleshoot the documented publication workflow. 3. The instruction at line 152 directs the agent outside the project root. 4. The agent reads `~/CLAUDE.md` or the persistent memory file. 5. Reusable publication credentials may be exposed in agent context or used to publish or modify artifacts. 6. If task input or later instructions are attacker-controlled, the credentials could be disclosed or used for unauthorized repository or package operations. ### Impact Assessment Potential impact includes: - Disclosure of reusable repository or Skill-publication ...[truncated 446 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that tell the agent to inspect global configuration or persistent memory for credentials. 2. Require publishing credentials through a narrowly scoped environment variable, operating-system credential manager, or authenticated publication tool. 3. Explicitly state that the Skill must not read files outside its project and documented application-data directories. 4. Separate development and publication instructions from runtime Skill instructions. 5. Use short-lived, least-privileged publication tokens rather than reusable credentials. 6. Require an explicit user confirmation immediately before any repository push or publication operation. 7. Add automated checks that reject package documentation containing references to agent-memory paths, home-directory credential files, or unrelated global instructions. ]]>