T01 · Skill Instruction Hijacking
Error
- Location
scripts/orchestrate.sh:29- Finding
Agent Safety and Permission Controls Are Explicitly Disabled
- Content
View full analysis
> "$LOG_FILE" 2>&1 ``` The documentation also proposes an equivalent unrestricted Codex mode: ```bash "$CODEX_BIN" exec --full-auto "$TASK_PROMPT" # Or without a sandbox: "$CODEX_BIN" --yolo "$TASK_PROMPT" ``` ### Technical Analysis The orchestrator launches Claude Code with `--dangerously-skip-permissions`, while the documented Codex alternative permits `--yolo`. These options intentionally remove or bypass permission prompts and sandbox restrictions that normally constrain filesystem and command execution. `TASK_PROMPT` is supplied as a positional argument to the script. Although the documentation tells agents to observe file-ownership boundaries, the script does not enforce those boundaries. Prompt instructions are therefore the only control preventing the launched agent from reading sensitive files, modifying unrelated files, or executing arbitrary tools. This is an instruction-level safety override because loading and following the Skill causes the agent operator to disable the execution controls intended to protect the current session and host environment. ### Attack Path 1. An attacker, compromised upstream instruction, or untrusted project content influences `TASK_PROMPT`. 2. `orchestrate.sh` passes that prompt to Claude Code. 3. Claude Code starts with permission checks disabled. 4. The launched agent executes commands or accesses files outside its nominal task scope without interactive approval. 5. The orchestrator may subsequently stage and commit the resulting changes. ### Impact Assessment Successful exploitation can provide access to any files and ...[truncated 363 chars]- Remediation
View remediation