T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/run-coding-cli.sh:49- Finding
Worker-Controlled Prompts Are Executed with CLI Safety Controls Disabled
- Content
View full analysis
&1 | tee "$log_file" exit_code=${PIPESTATUS[0]} ;; gemini) timeout "$timeout_secs" gemini -p "$(cat "$prompt_file")" -y 2>&1 | tee "$log_file" exit_code=${PIPESTATUS[0]} ;; qodercli) timeout "$timeout_secs" qodercli -p "$(cat "$prompt_file")" \ --yolo -w "$workspace" 2>&1 | tee "$log_file" exit_code=${PIPESTATUS[0]} ;; ``` ### Technical Analysis The wrapper passes prompt-file contents to authenticated coding agents while explicitly enabling non-interactive approval or permission-bypass modes: - Claude is invoked with `--dangerously-skip-permissions`. - Gemini is invoked with `-y`. - Qoder CLI is invoked with `--yolo`. According to the documented workflow, the prompt originates from a Worker message. The wrapper only verifies that the prompt file and workspace exist. It does not authenticate the prompt origin, inspect requested operations, isolate the CLI in a sandbox, restrict network access, or constrain filesystem access to the designated workspace. Although the prompt is passed as one quoted command-line argument and therefore does not directly create shell metacharacter injection in this script, it is interpreted as instructions by an autonomous coding agent. Because the agent's confirmation and permission protections are disabled, malicious prompt instructions can cause the CLI to invoke tools, run commands, read accessible files, or modify content without an intervening approval step. A timeout limits execution duration but does not restrict which resources the CLI can access during that ...[truncated 1605 chars]- Remediation
View remediation