T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:89
- Finding
- Delegated Agents Are Granted Unrestricted Automatic Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:89-98`; duplicated in `references/harness-list.md:50-68` **Vulnerability Type**: Unrestricted delegated-agent permissions **Risk Level**: High ### Vulnerable Code ```json { "defaultPermissions": "approve-all", "nonInteractivePermissions": "deny", "authPolicy": "skip" } ``` The accompanying documentation states that this configuration automatically approves all operations without displaying a confirmation prompt. The reference file further clarifies that `"approve-all"` includes write operations. ### Technical Analysis The documented configuration removes per-operation authorization for externally executed ACP harnesses. An agent spawned through this configuration can receive approval for security-sensitive capabilities, including file modification, without requiring the user to review each request. This violates the principle of least privilege because read-only, analytical, and narrowly scoped delegation tasks do not inherently require unrestricted write authorization. The use of `authPolicy: "skip"` also removes an authentication-flow safeguard, although the documentation correctly notes that this setting does not replace the underlying API credential. The exposure is especially significant because the harnesses are external agent implementations. A compromised dependency, malicious task, prompt-injected input, or unsafe model-generated action could use automatically approved capabilities. ### Attack Path 1. The user follows the Skill and globally configures `defaultPermissions` as `"approve-all"`. 2. The coordinator spawns an external ACP harness. 3. The harness processes malicious input, generates an unsafe action, or loads compromised package code. 4. The harness requests a write or other privileged operation. 5. The ACP runtime automatically approves the request without user confirmation. 6. The harness modifies any file or resource available to the coordinator's operating-sys ...[truncated 623 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `"approve-all"` with `"approve-reads"` as the default policy. - Require explicit user approval for file writes, command execution, network access, credential access, and operations involving sensitive directories. - Define per-agent and per-task permission allowlists instead of prescribing a permissive global policy. - Run delegated harnesses in an isolated container or sandbox with a read-only project mount when writes are unnecessary. - Restrict writable locations to a dedicated task-specific workspace. - Avoid requiring `authPolicy: "skip"` globally. Apply it only in narrowly controlled environments where authentication behavior and credentials are managed securely. - Document the residual risk whenever automatic approval is intentionally enabled. ]]>