T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/run-copilot-example.sh:21
- Finding
- Copilot CLI Is Granted Excessive Tool Permissions by Default## Vulnerability Details **File Location**: `scripts/run-copilot-example.sh:21` **Additional Locations**: `SKILL.md:21`, `SKILL.md:39`, `references/copilot-usage-recipes.md:8`, `references/copilot-usage-recipes.md:24`, `references/copilot-usage-recipes.md:36` **Vulnerability Type**: Excessive delegated-agent permissions **Risk Level**: High ### Vulnerable Code ```bash cd "$PROJECT_DIR" copilot -p "$TASK" --allow-all-tools ``` The same unsafe authorization pattern is recommended throughout the documentation: ```text copilot -p "<task>" --allow-all-tools ``` A documented alternative adds only a limited deny list: ```text copilot -p "<task>" --allow-all-tools --deny-tool 'shell(rm)' --deny-tool 'shell(git push)' ``` ### Technical Analysis The `--allow-all-tools` option grants the delegated Copilot agent broad access to its available tools instead of applying least privilege. In the executable example, this authorization is enabled unconditionally for every supplied task. There is no task-specific allowlist, confirmation boundary, repository trust check, or restriction on authenticated GitHub operations. Quoting `"$PROJECT_DIR"` and `"$TASK"` prevents direct shell argument injection into the wrapper itself, but it does not address semantic prompt injection. Instructions supplied through the task or encountered in an untrusted repository can influence Copilot after broad tool access has already been granted. The optional denial of `shell(rm)` and `shell(git push)` is insufficient as a general security boundary. It covers only two command patterns and does not comprehensively prevent alternative destructive commands, file modification, sensitive-file access, network communication, or other repository and GitHub mutations. ### Attack Path 1. A user invokes the script or follows a documented recipe against an untrusted or compromised repository. 2. The supplied task or repository content contains instructions that influence Copilot to perform actions beyo ...[truncated 979 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--allow-all-tools` from the executable script and all default usage examples. 2. Require explicit, task-specific `--allow-tool` entries. For example, a read-only review should receive only the minimum Git or file-reading capabilities it requires. 3. Deny shell execution, network access, repository publication, and destructive operations by default. Enable them only after explicit user confirmation. 4. Add confirmation checkpoints before any command that modifies files, invokes package managers, communicates externally, changes Git state, pushes commits, or creates and edits GitHub resources. 5. Validate that `PROJECT_DIR` resolves to an intended repository under an approved root, and reject unexpected or sensitive paths. 6. Treat repository files and task text as untrusted input. Warn users that repository-level instructions can influence the delegated agent. 7. Where broad autonomy is genuinely required, execute Copilot in an isolated container or sandbox with a dedicated workspace, minimal environment variables, no unrelated credentials, restricted network access, and a narrowly scoped GitHub token. 8. If deny rules are retained as defense in depth, expand them beyond `shell(rm)` and `shell(git push)`; do not treat pattern-based denials as a replacement for a positive allowlist.