T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:107- Finding
Unrestricted Build-Agent Execution Bypasses Approval and Sandbox Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:107-114
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: HighVulnerable Code
bash cat {task_dir}/spec_build.md | \ omx exec --dangerously-bypass-approvals-and-sandbox \ -o {task_dir}/result-{round:03d}.txt \ -C {cwd} \ {sandbox_args} - \ 2> {task_dir}/build-{round:03d}.log ; \ echo $? > {task_dir}/build-{round:03d}.exit_codeTechnical Analysis
The Build phase explicitly invokes OMX with
--dangerously-bypass-approvals-and-sandbox. This disables both interactive approval controls and execution isolation while the agent is expected to run commands and modify source files.The build specification incorporates project content, generated plans, and prior failure information. Those inputs may include untrusted repository text or unsafe model-generated instructions. Without a sandbox or approval gate, a malicious repository instruction or erroneous generated command can execute with the ambient privileges of the user running the Skill.
Although this behavior does not elevate privileges beyond the operating-system account itself, it breaks the intended least-privilege boundary between the target project and the rest of that account's accessible environment.
Attack Path
- An attacker places adversarial instructions in a repository file that the Planner or Builder analyzes.
- The generated plan or build specification carries an unsafe operation into the Build phase.
- The Skill starts OMX with approval checks and sandbox enforcement disabled.
- OMX follows the unsafe operation without requiring user confirmation.
- The operation accesses or changes resources outside the intended repository using the invoking user's permissions.
Impact Assessment
A successful exploitation could permit:
- Arbitrary command execution as the user invoking the Skill.
- Reading files and credentials accessible to that user.
- Modifying or deleting f ...[truncated 348 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--dangerously-bypass-approvals-and-sandbox. - Run the Builder in a project-scoped sandbox with only the target repository mounted writable.
- Make the task directory writable only where artifact generation requires it.
- Deny access to home-directory secrets, SSH material, credential stores, environment files, and unrelated repositories.
- Restrict network access by default and allow only explicitly required endpoints.
- Require user approval for shell execution, dependency installation, deletion, permission changes, and access outside the project.
- Validate the generated plan and enforce an allowlist of files that may be modified before starting the Builder.
- Compare actual changes against the allowlist and fail closed if out-of-scope files are touched.
- Execute under a dedicated low-privilege account or disposable container where feasible.
- Remove