T05 · Unauthorized Access and Privilege Escalation
Error
- Location
prompts/worker.md:23- Finding
Untrusted task content is executed by agents with unrestricted host and OAuth-backed capabilities
- Content
View full analysis
⚠️ **This is a high-privilege skill.** Read before using in batch/automated mode. **Spawned workers and judges inherit full host-agent runtime**, including: - `exec` (arbitrary shell commands) - `web_search`, `web_fetch` - All installed skills (including those with OAuth-bound credentials — Gmail, Drive, etc.) - `sessions_spawn` (workers can spawn further sub-agents) This means **the task description you provide directly controls what the worker does** — treat it like code you're about to run, not a message you're about to send. **Batch mode (`--no-interactive`) removes all human gates.** In interactive mode (default), you approve criteria and each checkpoint before the loop continues. In batch mode, criteria are auto-approved and the loop runs to completion autonomously — only use this for tasks and environments you fully trust. ``` `prompts/worker.md:23-28`: ```markdown ## Instructions 1. **Read the criteria before starting.** Internalize what PASS looks like. 2. **If there is judge feedback**, your first priority is to fix the specific gaps identified. Address each gap explicitly. 3. **Do the work.** Use whatever tools you need — exec, web_search, web_fetch, browser, etc. You have access to the full agent runtime. 4. **Write your output** to: `{{OUTPUT_PATH}}` ``` `scripts/run.py:50-63`: ```python def call_agent(prompt: str, session_id: str, timeout_s: int = 3600, max_retries: int = 5, base_backoff: int = 60) -> str: """ Spawn an agent session via the OpenClaw gateway (openclaw agent CLI). Each session gets the full agent runtime: all tools, all skills, OAuth auth. No direct Anthropic API c ...[truncated 3375 chars]- Remediation
View remediation