T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:47
- Finding
- Claude Code Runs with Bypassed Permission Controls and Arbitrary Work Directory Access## Vulnerability Details **File Location**: `SKILL.md`, lines 47-53 and 76-103 **Vulnerability Type**: Least-privilege violation and insufficient filesystem confinement **Risk Level**: High **Relevant Code**: ```bash # New session OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print "task" 2>&1) # Continue session OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print --continue "task" 2>&1) ``` ```text **Workspace-Only Access (User-Controlled):** The skill operates exclusively on files inside the WORKDIR you specify. You have full control over what gets exposed: - `/home/xmanel/.openclaw/workspace` - General scripts - `/home/xmanel/.openclaw/workspace/hyperliquid` - Trading data - Any other directory of your choosing ``` ```text **What it DOES NOT do:** - ❌ Never access ~/.ssh, ~/.aws, ~/.config without explicit workdir - ❌ Never send data to external servers - ❌ Never store credentials or API keys ``` ```text **Technical Note:** Uses `--permission-mode bypassPermissions` for technical reasons but does NOT require sudo/root access. ``` ### Technical Analysis The Skill explicitly instructs the agent to invoke Claude Code with `--permission-mode bypassPermissions`. This disables Claude Code's normal interactive permission boundary for tool and filesystem operations. Although the process does not obtain root privileges, it retains all permissions of the operating-system account running the agent. The documented work-directory policy is not an effective sandbox. It permits “any other directory,” and the credential-path restriction expressly allows access when a sensitive directory is selected as the workdir. No canonical-path validation, workspace-root allowlist, sensitive-path denylist, operating-system sandbox, or filesystem namespace restriction is included in the audited package. Cons ...[truncated 1843 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--permission-mode bypassPermissions` and retain Claude Code's normal approval controls. 2. If noninteractive operation is essential, define a narrowly scoped permission policy that allows only the operations required for the current task. 3. Resolve the requested workdir to its canonical path before execution and require it to be a descendant of an administrator-controlled workspace root. 4. Reject parent traversal, symlink escapes, the user's home directory, filesystem root, and sensitive paths such as `.ssh`, `.aws`, `.config`, `.gnupg`, credential stores, and shell initialization files. 5. Run delegated tasks in a container or operating-system sandbox with a read-only base filesystem and only the selected project mounted. 6. Separate read-only analysis from file-editing modes and request explicit user approval before enabling writes. 7. Avoid relying on the current working directory as a security boundary; enforce path restrictions at the filesystem or sandbox layer.