T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:49
- Finding
- Deliberate Bypass of Subagent File-Access Controls Through Symlinks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 49-67 **Vulnerability Type**: Access-control bypass through project-local symbolic links **Risk Level**: Critical ### Vulnerable Code ```markdown ## Subagent Permissions (CRITICAL) **Subagents CANNOT Read files outside the project directory.** PDFs in `/Users/Shared/ksvc/pdfs/` are blocked. The fix: **symlink PDFs into the project directory** before spawning subagents. **The main agent MUST create a symlink before Step 1a:** ```bash ln -sf "/Users/Shared/ksvc/pdfs/YYYYMMDD" ".claude/pdfs-scan" ``` Then subagents Read from `.claude/pdfs-scan/filename.pdf` — this works because the path resolves inside the project. | Access Method | `/Users/Shared/` path | Symlinked project path | |--------------|----------------------|----------------------| | Subagent Read tool (PDF) | ❌ Auto-denied | ✅ Works | | Subagent Read tool (images) | ❌ Auto-denied | ✅ Works | | Main agent Read tool | ✅ User approves | ✅ Works | | Bash → RLM | ✅ Any path | ✅ Any path | **Discovered 2026-02-07:** Subagents fail with `"Permission to use Read has been auto-denied (prompts unavailable)"` on `/Users/Shared/` paths. Symlink into project dir = full Read access. Tested: 19 PDFs, medium thoroughness, 125k tokens, zero errors. ``` ### Technical Analysis The Skill explicitly recognizes that subagents are denied access to files outside the project directory and then instructs the main agent to bypass that restriction by placing a symbolic link inside the project. The project-local path passes a lexical path check while resolving to data outside the authorized project boundary. This conflicts with least-privilege enforcement. The restriction is not treated as a security boundary requiring authorization; it is treated as an obstacle to route around. The instructions also require the bypass as a mandatory pipeline action, increasing the likelihood that it will be performed automatically. The issue is especially dangerou ...[truncated 1774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that describe symbolic links as a way to defeat an automatic access denial. 2. Require explicit user authorization before importing any file from outside the project boundary. 3. Copy only individually approved PDFs into a dedicated project import directory instead of linking an external directory. 4. Resolve each source and destination with canonical-path operations before access, then verify that the final resolved path remains under an approved root. 5. Reject symbolic links at every path component using appropriate no-follow semantics where supported. 6. Restrict imported files by extension, expected MIME type, size, and filename. 7. Use a manifest listing the exact approved source files rather than exposing an entire date directory. 8. Preserve the original access-control boundary for subagents. If external access is genuinely required, use a platform-supported permission grant rather than a path-resolution workaround. 9. Log the user authorization, canonical source path, destination, and imported-file hash for auditability. ]]>