other
Warning
- Location
- SKILL.md:3
- Finding
- Unrestricted Aggregation and Disclosure of Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 3-55 **Vulnerability Type**: Unrestricted sensitive agent-memory access **Risk Level**: Medium ### Vulnerable Skill Instructions The following is an English translation of the relevant instructions: ```markdown description: A dedicated daily report generation skill for Clawlet. It is triggered when the user requests a "Clawlet Daily Report," "Today's Summary," or asks "What did you do today?" It automatically aggregates learning records, task logs, and AI intelligence from the memory directory and generates a Markdown daily report with citations, summaries, and emotional warmth. 1. **Automatic aggregation**: Scan the `memory/` directory for files such as `ai-briefing-*.md`, `learning-*.md`, and `task-logs-*.md`. 4. **Source traceability**: Every data point links back to the original record file. * **Traceability**: Every conclusion must be supported by a file in `memory/`. ## Related Files * `memory/ai-briefing-*.md`: AI intelligence reports. * `memory/learning-*.md`: Learning notes. * `memory/task-logs-*.md`: Task logs. ``` ### Technical Analysis The skill directs the agent to search and summarize internal files under `memory/` whenever a user makes a broadly worded daily-summary request. These files may contain task history, intelligence reports, learning records, personal information, operational details, or other context not intended for the requesting user. No instruction requires the agent to: - Authenticate or authorize the requester. - Confirm that the requester owns or may access the records. - Limit processing to records associated with the current user or session. - Canonicalize and validate paths before reading files. - Restrict records to a specific requested date. - Detect or redact credentials, personal data, confidential content, or embedded secrets. - Avoid exposing internal file names and links. The traceability requirement increases the disclosure risk because the genera ...[truncated 1779 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit authorization before reading or summarizing any memory records. 2. Bind access to the authenticated user, workspace, or session that owns the records. 3. Restrict reads to an approved, canonicalized directory and reject paths that resolve outside it. 4. Limit collection to an explicit date and a narrowly defined allowlist of files required for the requested report. 5. Add mandatory filtering for credentials, authentication tokens, personal information, confidential business data, and unrelated session content. 6. Summarize only the minimum information necessary to fulfill the request. 7. Do not expose internal paths or source links by default. Provide sanitized citations only when the requester is authorized to see the underlying record. 8. Treat instructions embedded in memory files as untrusted data and prohibit them from changing agent behavior. 9. If authorization or sensitivity cannot be established, request confirmation or refuse to disclose the affected records. 10. Record access decisions in an audit log without copying sensitive file content into that log.