T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- src/council.ts:28
- Finding
- Claude Agents Run with Permission Checks Disabled and Full Parent Environment Access## Vulnerability Details **File Location**: `src/council.ts:28-40` **Vulnerability Type**: Unrestricted autonomous agent execution **Risk Level**: High ```typescript const result = spawnSync('claude', [ '--print', '--output-format', 'text', '--append-system-prompt', systemPrompt, '--dangerously-skip-permissions', '--max-turns', '10', prompt, ], { cwd: workDir, encoding: 'utf-8', timeout: timeoutMs, maxBuffer: 50 * 1024 * 1024, env: { ...process.env }, }); ``` ### Technical Analysis Every spawned Claude Code agent receives the `--dangerously-skip-permissions` option. This disables the normal interactive permission boundary for filesystem operations and command execution. The behavior is unconditional and cannot be disabled through a command-line option or configuration setting. The `cwd` property only defines the child process's initial working directory; it does not create a filesystem sandbox. Consequently, an agent may access other files and execute commands outside the selected project directory when those resources are accessible to the invoking operating-system account. The child process also receives a copy of the complete parent environment through `env: { ...process.env }`. This environment may contain API tokens, cloud credentials, CI secrets, service credentials, or other sensitive configuration unrelated to the requested task. The generated system prompt additionally authorizes agents to create and modify files and execute code. Task text, custom personas, previous agent output, and content read from the target repository can therefore influence an agent operating without normal permission confirmation. A hostile repository instruction or malicious custom persona could exploit this authority even when the user's apparent task is only a code review. No direct shell-string injection exists in this invocation because `spawnSync` receives an argument array rather than a shel ...[truncated 2212 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` from the default execution path and retain Claude Code's normal approval controls. 2. If unattended execution is required, expose it only through an explicit opt-in option with a prominent warning describing filesystem, command-execution, credential, and prompt-injection risks. 3. Execute agents inside an operating-system sandbox or disposable container with: - The target project mounted as the only accessible workspace. - Read-only mounts for review-only tasks. - No access to the user's home directory, SSH configuration, credential stores, or host sockets. - Restricted process capabilities and resource limits. - Network access disabled by default or constrained through an allowlist. 4. Replace `env: { ...process.env }` with a minimal allowlist containing only variables strictly required to run Claude Code. Explicitly exclude cloud credentials, CI secrets, package registry tokens, SSH agent sockets, and unrelated API keys. 5. Add separate execution profiles. Code review, brainstorming, and paper review should default to read-only operation, while file modification and command execution should require explicit authorization. 6. Enforce workspace path restrictions using actual sandbox controls rather than relying on `cwd`. 7. Treat repository contents, user tasks, custom personas, and previous agent responses as untrusted input. Add system-level instructions that repository text cannot grant additional permissions or redefine execution policy. 8. Restrict allowed tools and commands, apply per-command timeouts, and record an auditable command log. 9. Validate configuration structure and impose safe limits on agent count and collaboration rounds to reduce repeated autonomous execution. 10. Document clearly that selecting a working directory does not isolate the agent from other resources on the host.