T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:75
- Finding
- Permission Controls Can Be Disabled Through Recommended YOLO Mode## Vulnerability Details **File Location**: `SKILL.md:75`, with repeated recommendations at `SKILL.md:93`, `SKILL.md:418`, `SKILL.md:546`, and `SKILL.md:576` **Vulnerability Type**: Permission bypass and excessive privileges **Risk Level**: High **Vulnerable code:** ```bash # Yolo mode (skip permissions) bash workdir:~/project command:"qodercli --yolo -p 'Make the changes'" ``` The permission-denied troubleshooting guidance also recommends bypassing controls: ```bash ### Permission Denied ```bash # Use yolo mode (caution) qodercli --yolo -p "task" # Or configure permissions in ~/.qoder/settings.json ``` ``` ### Technical Analysis The `--yolo` option explicitly skips Qoder CLI permission checks. The Skill presents this option in basic usage, the quick-reference material, and as a response to permission failures. This weakens the least-privilege boundary intended to constrain file access, shell execution, and other agent tools. Coding tasks may legitimately require access to selected project files and build commands, but they do not normally require disabling all permission checks. Recommending a blanket bypass exceeds the minimum privileges necessary for the declared functionality. The risk is amplified because Qoder processes natural-language prompts and repository content. Malicious instructions in source files, dependency metadata, `AGENTS.md`, or an MCP response could influence the agent to perform unintended operations. With permission checks disabled, those operations may proceed without user approval. ### Attack Path 1. An attacker places malicious or misleading instructions in a repository, dependency, generated file, `AGENTS.md`, or connected MCP response. 2. The user invokes Qoder against that workspace using the documented `--yolo` option, or enables it after encountering a permission-denied error. 3. Qoder interprets the attacker-controlled content as part of the task context. 4. The infl ...[truncated 795 chars]
- Remediation
- ## Remediation Suggestions - Remove `--yolo` from basic usage, quick-reference, and troubleshooting guidance. - Do not treat a permission failure as a reason to disable authorization controls. - Use `--allowed-tools` to expose only the minimum required tools, such as read-only access for reviews or narrowly scoped write access for implementation tasks. - Use `--disallowed-tools=Bash` when shell access is unnecessary. - Define explicit allow rules for the target workspace and deny access to credentials, SSH material, shell configuration, cloud configuration, and unrelated directories. - Require explicit, informed user confirmation before any exceptional permission bypass. - Prefer a sandbox, container, or low-privilege operating-system account for agent execution. - Document task-specific permission profiles rather than a universal unrestricted mode.