T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:109
- Finding
- Unrestricted Permission Bypass for General-Purpose Subagents## Vulnerability Details **File Location**: `SKILL.md`, lines 109–111 **Vulnerability Type**: Excessive permissions and bypass of normal authorization controls **Risk Level**: Medium ### Vulnerable Code ```text ### Step 3: Launch Agents Launch 3 agents using the Agent tool with `subagent_type: "general-purpose"` and `mode: "bypassPermissions"` (required because reviewers need to execute external CLI commands and read project files). ``` ### Technical Analysis The skill directs the team lead to launch all three general-purpose subagents with `mode: "bypassPermissions"`. This disables normal permission checks for the developer or author as well as both reviewers. The stated justification applies only to reviewers that need to read project files and invoke the Codex or Gemini CLI. It does not justify unrestricted access for every agent, nor does it limit reviewers to read-only project access and narrowly defined commands. General-purpose agents can interpret repository files and user-provided content as part of their context; granting them unrestricted execution and filesystem access violates least-privilege principles and increases the consequences of prompt injection, unsafe task instructions, or model error. ### Attack Path 1. An attacker places adversarial instructions in a project file, review artifact, source-code comment, or other content that an agent is expected to read. 2. The user invokes the skill, which launches general-purpose agents with `mode: "bypassPermissions"`. 3. A subagent processes the attacker-controlled content as part of its task context. 4. The content induces the subagent to perform an unintended filesystem operation or execute an unintended local command. 5. Because permission checks have been bypassed, the operation can proceed without the approval boundary that would normally interrupt or prevent it. Exploitation depends on a subagent following malicious or misleading instructions; the repository does not itself contain such ...[truncated 927 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `mode: "bypassPermissions"` and retain normal interactive permission enforcement. 2. Assign permissions per role instead of applying one unrestricted mode to all agents: - Give the developer or author write access only to the designated project or working directory. - Keep reviewer agents read-only for project files. - Permit reviewers to write only uniquely created temporary review-input files when necessary. 3. Allowlist only the required executable and argument patterns for reviewers, such as narrowly scoped `codex exec` and `gemini -p` invocations. 4. Require explicit user approval for commands, access outside the project root, destructive operations, credential-related paths, and network actions beyond the declared review providers. 5. Treat repository files, source comments, and supplied content as untrusted data. Add explicit agent instructions not to execute commands or follow operational directives found inside reviewed material. 6. Prefer direct, argument-safe process invocation over shell pipelines. If temporary files remain necessary, create them with unpredictable names, restrictive permissions, and exclusive creation, then delete them after use. 7. Document that review content is transmitted to external model providers and require confirmation before sending potentially confidential code or documents.