T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/amp-task.sh:125
- Finding
- Amp Is Unconditionally Granted Unrestricted Tool Permissions## Vulnerability Details **File Location**: `scripts/amp-task.sh:125-135`; also documented as the recommended behavior in `SKILL.md:46-52`, `SKILL.md:68-71`, and `SKILL.md:157-159` **Vulnerability Type**: Unrestricted autonomous tool execution and violation of least privilege **Risk Level**: High **Vulnerable code in `scripts/amp-task.sh:125-135`:** ```bash cd "$DIR" printf '%s' "$TASK" | "$AMP_BIN" \ threads continue "$THREAD_ID" \ --dangerously-allow-all \ --no-notifications \ --no-ide \ -m "$MODE" \ -x ``` **Recommended invocation in `SKILL.md:46-52`:** ```bash cd /path/to/project && \ amp \ --dangerously-allow-all \ --no-notifications \ --no-ide \ -m smart \ -x "Your task description here" ``` **Relevant flag description in `SKILL.md:68-71`:** ```markdown | Flag | Effect | |---------------------------|-----------------------------------------------------| | `--dangerously-allow-all` | No confirmation prompts — agent acts autonomously | ``` **Security warning in `SKILL.md:157-159`:** ```markdown - Amp commits are tagged with `Amp-Thread:` trailer in git. Use this to find amp-authored commits. - The `--dangerously-allow-all` flag bypasses all tool permission checks. Only use on trusted projects. - Amp may make mistakes. Review the diff after large changes: `git diff HEAD~1` ``` ### Technical Analysis The wrapper always supplies `--dangerously-allow-all` when invoking Amp. The documentation confirms that this option bypasses all tool permission checks. No explicit opt-in, interactive approval, command allowlist, filesystem sandbox, network restriction, or validation that the selected directory belongs to a trusted workspace is implemented. Although autonomous code modification is the declared purpose of the Skill, suppressing every permission boundary grants substantia ...[truncated 2625 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--dangerously-allow-all` from the default wrapper invocation and from the recommended one-shot command. 2. Preserve tool confirmation prompts by default, particularly for shell execution, network access, credential access, and writes outside the project. 3. If unrestricted operation remains necessary, introduce an explicit option such as `--allow-all` and require a clear per-run confirmation warning. Do not enable it implicitly. 4. Restrict `--dir` to an approved workspace root. Resolve the supplied path to its canonical form and reject paths outside that root, including traversal and symlink escapes. 5. Run Amp in a sandbox or disposable container with only the selected repository mounted writable. Mount unrelated host paths as inaccessible or read-only. 6. Use a minimally privileged operating-system account without access to personal credentials, SSH keys, cloud tokens, production secrets, or unrelated repositories. 7. Restrict outbound network access unless the delegated task explicitly requires it. Allowlist necessary destinations where feasible. 8. Require review of generated diffs and command logs before commits are accepted, artifacts are published, or changes are deployed. 9. Clearly distinguish trusted and untrusted repositories in the documentation. Untrusted repositories must never be processed in unrestricted mode. 10. Add automated tests verifying that the default invocation does not contain `--dangerously-allow-all` and that directories outside the configured workspace are rejected.