T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:174
- Finding
- Unattended Agent Execution Can Modify and Publish Repository Content Without Review<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66, 89, 109–112, 174–182, and 293 **Vulnerability Type**: Unsafe auto-approval combined with repository publication **Risk Level**: Medium ### Complete Code Snippets The skill recommends running the coding agent with automatic approval: ```bash # Start background task bash pty:true workdir:~/project background:true command:"agent --yolo 'Refactor the auth module'" ``` The documentation explicitly defines this option as dangerous: ```markdown | `--yolo` / `--force` | Auto-approve all operations (dangerous but fast) | ``` It then demonstrates unattended execution that instructs the agent to commit and push changes: ```bash # 2. Launch agent in each worktree (background + PTY) bash pty:true workdir:/tmp/issue-78 background:true command:"agent --yolo 'Fix issue #78: login bug. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"agent --yolo 'Fix issue #99: API timeout. Commit and push.'" # 3. Monitor progress process action:list process action:log sessionId:XXX # 4. Create PRs cd /tmp/issue-78 && git push -u origin fix/issue-78 gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..." ``` The behavior is also promoted as a general rule: ```markdown 3. **--yolo for building** - Auto-approve changes ``` ### Technical Analysis The `--yolo`/`--force` mode removes interactive authorization checks for operations selected by the delegated Cursor Agent. Although the skill acknowledges that this mode is dangerous, it repeatedly recommends it as the normal mode for building and modifying software. The risk becomes more significant when auto-approval is combined with instructions to commit and push. The delegated agent can inherit access available to the invoking process, including: - Read and write access within the selected worktree or working directory. - Execution of development tools and project-controlled commands. - Access to config ...[truncated 2523 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove auto-approval as the default** - Replace the rule `--yolo for building` with approval-required execution. - Reserve `--yolo` for exceptional, explicitly authorized cases. 2. **Require explicit informed consent** - Before using `--yolo` or `--force`, explain the exact working directory, expected commands, available credentials, and potential network effects. - Require a direct user confirmation for each unattended run. 3. **Separate modification from publication** - Do not instruct the delegated agent to commit and push automatically. - Require the agent to stop after producing local changes. - Have the user inspect `git status`, `git diff`, and the complete commit contents before committing. - Require a separate confirmation before any push or pull-request creation. 4. **Apply least-privilege isolation** - Continue using dedicated temporary worktrees, but also run the agent in a sandbox with access restricted to the task directory. - Disable unnecessary network access. - Avoid exposing general-purpose Git, cloud, package-registry, or deployment credentials. - Use short-lived, repository-scoped tokens where remote access is necessary. 5. **Use safer execution modes first** - Run `--plan` initially to inspect the proposed approach. - Use approval-required interactive mode for implementation. - Permit only a predefined set of commands when automation is necessary. 6. **Add repository-content trust boundaries** - Tell the delegated agent that instructions contained in source files, issues, pull requests, comments, and build output are untrusted data. - Require user approval before following instructions that request command execution, credential access, external communication, or Git publication. 7. **Add post-execution security checks** - Review generated diffs manually. - Run secret scanning, static analysis, and tests before commit. - Use branch protect ...[truncated 105 chars]