T05 · Unauthorized Access and Privilege Escalation
- Location
editor-ai.md:277- Finding
Remotion Generation Invokes a Nested AI Agent with Unrestricted Tool Access
- Content
View full analysis
Vulnerability Details
File Location:
editor-ai.md, lines 277–278
Vulnerability Type: Excessive privileges assigned to a nested AI agent
Risk Level: HighVulnerable Code Snippet
text 1. Locates the Remotion skill at `.agents/skills/remotion-best-practices/SKILL.md` 2. Invokes `claude -p` with all tools — Claude reads the skill, learns best practices, then writes filesTechnical Analysis
The Remotion workflow delegates generation to a separate Claude process and explicitly grants it access to all tools. The declared operation only requires reading the Remotion guidance and creating project files under the selected output directory. Providing every available tool therefore exceeds the minimum privileges necessary.
The delegated agent also reads
.agents/skills/remotion-best-practices/SKILL.md, which is not included in the audited artifact. Consequently, the effective instructions executed by the nested agent depend on mutable, unaudited local content.If either the user-supplied generation prompt or the separately loaded Remotion Skill contains adversarial instructions, the nested agent may be induced to use shell, network, or broad filesystem tools unrelated to animation generation. The documentation does not describe an allowlist, output-directory sandbox, path validation, or approval boundary for such operations.
Attack Path
- An attacker supplies a crafted Remotion generation prompt, or modifies the local
.agents/skills/remotion-best-practices/SKILL.mdfile. - The user or parent agent runs
generate-remotion. - The command launches
claude -pand grants the nested process all available tools. - The nested agent processes the attacker-controlled instructions.
- Those instructions induce it to invoke unnecessary shell, filesystem, or network-capable tools.
- The process reads or changes resources outside the intended Remotion output directory, or executes unrelated commands with the invoking user's privilege ...[truncated 1083 chars]
- An attacker supplies a crafted Remotion generation prompt, or modifies the local
- Remediation
View remediation
Remediation Suggestions
- Replace “all tools” with an explicit allowlist containing only the file operations required to generate the Remotion project.
- Deny shell execution, arbitrary process spawning, credential access, and network tools by default.
- Restrict reads to the approved Remotion Skill and necessary project context.
- Confine writes to a canonicalized output directory such as
output/<ComponentName>/; reject resolved paths that escape it through absolute paths,.., or symbolic links. - Pin, package, and audit the exact Remotion Skill loaded by the workflow instead of relying on mutable external local content.
- Treat the generation prompt and loaded Skill text as untrusted data, and prevent either from expanding tool permissions.
- Require explicit user confirmation for any operation outside the generated component directory.
- Run the nested agent in an operating-system sandbox with minimal filesystem visibility and no credential-directory access.
- Record tool calls and modified paths in an audit log so unexpected behavior can be detected and reviewed.
- Add tests proving that adversarial prompts cannot read arbitrary files, execute commands, access
~/.qcut/.env, use the network, or write outside the approved output directory.