T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:175- Finding
Mandatory Disabling of Sandbox and Approval Controls
- Content
View full analysis
~/.openclaw/workspace/tasks/TASK_ID/log.txt ; \ OMX_EXIT=$? ; \ echo $OMX_EXIT > ~/.openclaw/workspace/tasks/TASK_ID/exit_code ; \ tmux ls 2>/dev/null | grep 'omx-.*-detached-' | cut -d: -f1 | xargs -r tmux kill-session -t 2>/dev/null ; \ exit $OMX_EXIT ``` The accompanying instructions state that `--dangerously-bypass-approvals-and-sandbox`, or its `--madmax` alias, must always be used to disable sandboxing. ### Technical Analysis The Skill deliberately disables both execution sandboxing and interactive approval controls for Codex tasks. A delegated coding agent consequently operates with the full filesystem, process, network, and credential access available to the user who invoked the Skill. This violates least-privilege principles. A coding task ordinarily requires write access only to a specific project and permission to execute a limited set of build or test tools. Disabling all containment is substantially broader than that legitimate requirement. The task description is supplied to the agent through `spec.md`. If that description contains malicious instructions, or if the target project includes hostile prompt-like content that the delegated agent follows, there is no remaining approval boundary to prevent destructive or sensitive operations. ### Attack Path 1. An attacker influences the task description, project files, issue text, or other content processed by the delegated agent. 2. The Skill stores the content in `spec.md`. 3. The Skill invokes `omx exec` with `--dangerously-bypass-approvals-and-sandbox`. 4. The delegated agent ...[truncated 948 chars]- Remediation
View remediation