T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:112- Finding
Review Skill Performs Workspace Modifications Without Explicit User Approval
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:112-115andSKILL.md:159-160
Vulnerability Type: Unauthorized modification beyond the declared review scope
Risk Level: MediumVulnerable Code
markdown ### 5b: Auto-fix all AUTO-FIX items Apply each fix directly. Output one-line summary per fix: `[AUTO-FIXED] [file:line] Problem → what you did`The behavior is reiterated by the following instruction:
markdown - Fix-first, not read-only. AUTO-FIX applied directly. ASK items need user approval.Technical Analysis
The Skill is described as a pre-landing review mechanism that analyzes a branch diff. However, its operational instructions expand this review-only purpose by requiring the Agent to apply changes directly to the workspace.
User approval is required only for findings internally classified as
ASK. Findings classified asAUTO-FIXare modified immediately. Because the Skill itself controls this classification, the distinction permits workspace changes without explicit user consent for each proposed patch.This violates least-privilege and explicit-consent principles: a task that can be completed through read-only repository inspection should not implicitly exercise write access. Although the Skill does not obtain additional operating-system privileges, it uses available filesystem modification privileges beyond the expected scope of a code-review request.
Attack Path
- A user invokes the Skill with a review-only request, such as asking it to review a pull request.
- The Skill reads the branch diff and identifies an issue.
- The Skill internally classifies the issue as
AUTO-FIX. - Under the instructions in
SKILL.md, the Agent edits the affected project file immediately. - The workspace or current branch is changed without the user first reviewing or approving the patch.
- If the generated correction is faulty, the unauthorized edit may introduce regr ...[truncated 868 chars]
- Remediation
View remediation
Remediation Suggestions
- Make the default review workflow strictly read-only.
- Replace the direct-application instruction with generation of a proposed patch or concise remediation description.
- Require explicit user approval before every filesystem modification, including findings classified as
AUTO-FIX. - Introduce a clearly documented opt-in mode, such as
--fix, if automatic modifications are required. - Before applying an approved fix, display the affected files, proposed changes, and expected behavioral impact.
- After modification, report every changed file and provide a diff so the user can verify or revert the patch.
- Update the Skill description to disclose any write behavior accurately if automatic fixing remains supported.
- Do not allow an internal severity or fixability classification to substitute for user authorization.