Amp Code

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:20 PM UTC
• Version: 1.0.0

Overview

The skill is transparent about delegating code changes to Amp, but its default wrapper disables permission checks for any chosen directory, so users should review it carefully before use.

Install only if you intend to let Amp modify and test code without interactive permission prompts. Use it only on trusted repositories, preferably in a disposable or sandboxed workspace with no unrelated secrets, and review diffs and command/thread logs before accepting or publishing changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/amp-task.sh:125

Finding

Amp Is Unconditionally Granted Unrestricted Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/amp-task.sh:125-135; also documented as the recommended behavior in SKILL.md:46-52, SKILL.md:68-71, and SKILL.md:157-159
Vulnerability Type: Unrestricted autonomous tool execution and violation of least privilege
Risk Level: High

Vulnerable code in scripts/amp-task.sh:125-135:

bash

cd "$DIR"

printf '%s' "$TASK" | "$AMP_BIN" \
  threads continue "$THREAD_ID" \
  --dangerously-allow-all \
  --no-notifications \
  --no-ide \
  -m "$MODE" \
  -x

Recommended invocation in SKILL.md:46-52:

bash

cd /path/to/project && \
  amp \
    --dangerously-allow-all \
    --no-notifications \
    --no-ide \
    -m smart \
    -x "Your task description here"

Relevant flag description in SKILL.md:68-71:

markdown

| Flag                      | Effect                                              |
|---------------------------|-----------------------------------------------------|
| `--dangerously-allow-all` | No confirmation prompts — agent acts autonomously   |

Security warning in SKILL.md:157-159:

markdown

- Amp commits are tagged with `Amp-Thread:` trailer in git. Use this to find amp-authored commits.
- The `--dangerously-allow-all` flag bypasses all tool permission checks. Only use on trusted projects.
- Amp may make mistakes. Review the diff after large changes: `git diff HEAD~1`

Technical Analysis

The wrapper always supplies --dangerously-allow-all when invoking Amp. The documentation confirms that this option bypasses all tool permission checks. No explicit opt-in, interactive approval, command allowlist, filesystem sandbox, network restriction, or validation that the selected directory belongs to a trusted workspace is implemented.

Although autonomous code modification is the declared purpose of the Skill, suppressing every permission boundary grants substantia ...[truncated 2625 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --dangerously-allow-all from the default wrapper invocation and from the recommended one-shot command.
2. Preserve tool confirmation prompts by default, particularly for shell execution, network access, credential access, and writes outside the project.
3. If unrestricted operation remains necessary, introduce an explicit option such as --allow-all and require a clear per-run confirmation warning. Do not enable it implicitly.
4. Restrict --dir to an approved workspace root. Resolve the supplied path to its canonical form and reject paths outside that root, including traversal and symlink escapes.
5. Run Amp in a sandbox or disposable container with only the selected repository mounted writable. Mount unrelated host paths as inaccessible or read-only.
6. Use a minimally privileged operating-system account without access to personal credentials, SSH keys, cloud tokens, production secrets, or unrelated repositories.
7. Restrict outbound network access unless the delegated task explicitly requires it. Allowlist necessary destinations where feasible.
8. Require review of generated diffs and command logs before commits are accepted, artifacts are published, or changes are deployed.
9. Clearly distinguish trusted and untrusted repositories in the documentation. Untrusted repositories must never be processed in unrestricted mode.
10. Add automated tests verifying that the default invocation does not contain --dangerously-allow-all and that directories outside the configured workspace are rejected.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to run Amp with --dangerously-allow-all, which disables permission prompts and allows an autonomous agent to read, modify, and test code without human approval at each step. In the context of a delegation skill for multi-file coding tasks, this materially increases the risk of unsafe file changes, execution of harmful commands, exposure of secrets in the workspace, or destructive repository actions if the task, prompt, or codebase is untrusted or the agent behaves unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

| Flag                      | Effect                                              |
|---------------------------|-----------------------------------------------------|
| `--dangerously-allow-all` | No confirmation prompts — agent acts autonomously   |
| `--no-notifications`      | Suppress sound/system notifications                 |
| `--no-ide`                | Don't connect to IDE (safe for headless runs)       |
| `-x "message"`            | Execute mode: non-interactive, prints final output  |

Static analysis

No suspicious patterns detected.