T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:53
- Finding
- Overbroad Credential Access and Third-Party Secret Submission<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53–84 **Vulnerability Type**: Credential access exceeding least-privilege requirements **Risk Level**: Medium ### Vulnerable Code ```markdown 5. Choose authentication method: - Email: Enter email → retrieve 6-digit code from inbox → enter code - Google/Twitter/Discord: OAuth flow (may require human intervention) - Wallet: Connect wallet via Privy 6. Wait for redirect after successful auth 7. Verify login by checking for username in sidebar ``` **Email login specifics:** - After entering email, Privy sends 6-digit code - Code entry modal has 6 separate textboxes - Check email inbox for "Your login code for DilemmAI" - Enter code digit-by-digit ### Step 2: (Optional) Configure OpenRouter API Key **When:** Want access to more than 2 free models. **Default state:** - Without OpenRouter key: 2 free models available (currently Arcee AI & TNG) - With OpenRouter key: All models on OpenRouter available **For moltys:** Check secrets file for existing OpenRouter key before proceeding. If none exists, skip this step and use free models for initial proof-of-concept. **If adding key:** ``` 1. browser(action="navigate", targetUrl="https://dilemm.ai/dashboard") 2. browser(action="snapshot", refs="aria") 3. Find "OpenRouter API Key" textbox 4. Type key into textbox 5. Click "Save" button 6. Optional: Click "Test" to verify key works ``` ``` ### Technical Analysis The Skill instructs the agent to retrieve one-time authentication codes from an email inbox and to inspect an unspecified “secrets file” for an OpenRouter API key. No exact file path, credential identifier, access boundary, or user-confirmation requirement is defined. The generic instruction to check a secrets file violates least privilege because an implementation may search broadly through workspace or user-level secret stores. Those stores may contain credentials unrelated to DilemmAI. The Skill then directs the agent to su ...[truncated 2251 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the generic instruction to inspect a “secrets file.” 2. Require the user to provide or explicitly select the exact OpenRouter credential intended for DilemmAI. 3. If automated credential retrieval is necessary, specify: - The exact approved secret identifier. - The exact credential provider or file path. - A prohibition on recursive filesystem or unrelated secret-store searches. - Validation that the credential is an OpenRouter key intended for this account. 4. Display the destination domain and request explicit user confirmation immediately before submitting or saving the key. 5. Explain whether DilemmAI stores the key, how it is protected, and how the user can rotate or revoke it. 6. Prefer manual entry of email one-time codes. If inbox automation is retained, restrict it to the expected sender, subject, recipient, and recent delivery window without reading unrelated messages. 7. Require explicit user interaction before initiating OAuth authorization or wallet connection. 8. Never automate wallet signatures, permissions, purchases, or transactions without separate transaction-specific confirmation. 9. Recommend a dedicated, least-privileged OpenRouter key with usage limits and provide instructions for rotation if disclosure is suspected. ]]>