T09 · Insecure Skill Coding Practices
Error
- Location
- modules/messaging-protocol.md:21
- Finding
- Unauthenticated Coordination Messages and Mutable Authorization State<![CDATA[ ## Vulnerability Details **File Location**: `modules/messaging-protocol.md:14-29, 62-126, 130-151`; `modules/crew-roles.md:23-37, 70-81`; `modules/team-management.md:64-73` **Vulnerability Type**: Unauthenticated inter-agent communication and insufficient authorization controls **Risk Level**: High ### Vulnerable Code Segments The inbox is a directly writable JSON file: ```text ~/.claude/teams/<team>/inboxes/<agent-name>.json ``` Messages contain a caller-controlled sender identity without an authentication field: ```json { "from": "team-lead", "text": "Implement the auth middleware next", "timestamp": "2026-02-07T22:00:00Z", "read": false, "summary": "Auth middleware task", "color": "#FF6B6B" } ``` The protocol permits security-sensitive messages such as plan approvals: ```json { "from": "team-lead", "type": "plan_approval", "text": "{\"task_id\": \"3\", \"approved\": true, \"notes\": \"Proceed with approach A\"}", "timestamp": "2026-02-07T22:20:00Z", "summary": "plan approved: T3" } ``` Inbox writes are protected against concurrent corruption, but not against unauthorized writers or sender impersonation: ```python import fcntl lock_path = inbox_dir / ".lock" lock_path.touch() with open(lock_path) as lock_fd: fcntl.flock(lock_fd, fcntl.LOCK_EX) # Acquire exclusive lock try: # Read, modify, write inbox JSON messages = json.loads(inbox_path.read_text()) messages.append(new_message) inbox_path.write_text(json.dumps(messages)) finally: fcntl.flock(lock_fd, fcntl.LOCK_UN) # Release lock ``` Missing role information defaults to a role with full tool access: ```markdown **Default role**: `implementer` (backward compatible — members without an explicit role are treated as implementers). ``` ```markdown | Capability | implementer | researcher | tester | reviewer | architect | |-----------|:-----------:|:----------:|:------:|:--------:|:---------:| | Read files | Yes | Y ...[truncated 4984 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Authenticate every message** - Assign each team session or member a cryptographically random key. - Add a message identifier, sender identity, recipient identity, timestamp, nonce, and HMAC or digital signature. - Verify authentication before parsing or acting on message contents. - Derive sender identity from an authenticated channel where possible rather than trusting the JSON `from` field. 2. **Enforce message-level authorization** - Permit only the authenticated lead to send plan approvals, shutdown requests, role changes, task reassignments, and health-control messages. - Define an explicit authorization matrix for every message type. - Reject unknown types, unexpected fields, invalid state transitions, and unauthorized senders. 3. **Apply restrictive filesystem controls** - Create team and task directories with mode `0700`. - Create inbox, task, lock, and configuration files with mode `0600`. - Verify file ownership before every read or write. - Refuse symlinks and use descriptor-relative operations with `O_NOFOLLOW` where supported. - Validate canonical paths remain beneath the expected team directory. 4. **Separate authorization state from teammate-writable data** - Do not allow ordinary teammate processes to modify `config.json`. - Route role changes through an authenticated lead-only API. - Maintain immutable audit records for role changes and privileged messages. - Revalidate active tasks immediately after every authorized role change. 5. **Fail closed for missing or invalid roles** - Replace the full-tool `implementer` default with a least-privileged role. - Reject missing, unknown, or malformed role values. - Require explicit authorization before granting file-writing, Git, build, or command-execution capabilities. 6. **Harden inbox processing** - Enforce strict JSON schemas and message-size limits. - Track unique message IDs and reject duplica ...[truncated 415 chars]