T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:52
- Finding
- Coding Agents Run Without Effective Least-Privilege Filesystem Controls## Vulnerability Details **File Location**: `SKILL.md:52-57`, with affected launch recipes at `SKILL.md:148-149` and `SKILL.md:173-174` **Vulnerability Type**: Permission-control bypass and unrestricted user-level execution **Risk Level**: High ### Evidence ```text 4. **Permission flags are not a sandbox.** The claude adapter spawns its binary with `--allow-dangerously-skip-permissions --setting-sources=project,local`, so no permission request ever reaches acpx's policy layer (`--deny-all` is unreachable, not ignored); codex writes through its terminal capability. `--no-terminal` genuinely removes the terminal capability, but the only real filesystem control is which `--cwd` you hand it. Verify: `ps -Ao args | grep claude-agent-sdk` mid-turn. ``` The affected recommended recipes include: ```bash acpx --cwd "$D" --approve-all --timeout 5400 --format quiet --suppress-reads \ codex -s work 'Carry out ./brief.md. Write your report to ./report.md.' > run.log 2>&1 & ``` ```bash acpx --cwd "$D" --model claude-opus-5 --approve-all --suppress-reads --timeout 2400 \ claude -s work -f /abs/brief.md >> run.log 2>&1 & ``` ### Technical Analysis The recommended execution model bypasses or disables interactive permission checks while retaining terminal and filesystem capabilities. The Skill explicitly states that the Claude adapter invokes its underlying binary with `--allow-dangerously-skip-permissions`, preventing permission requests from reaching the `acpx` policy layer. It also states that Codex can write through its terminal capability. The `--cwd` option changes the process working directory but does not establish an operating-system security boundary. Unless the agent is separately isolated, it can potentially access any file, executable, credential, socket, or service available to the invoking user. Consequently, repository content, prompts, or tool output capable of influencing the coding ...[truncated 1561 chars]
- Remediation
- ## Remediation Suggestions 1. Do not make `--approve-all` the default in documented launch recipes. Require explicit approval for terminal execution and filesystem writes. 2. Use `--no-terminal` for review, classification, and other analysis-only tasks. 3. Run coding agents inside a container, virtual machine, sandbox, or dedicated restricted operating-system account. 4. Mount only the target project into the isolated environment and use a read-only mount unless writes are necessary. 5. Do not expose home directories, SSH agents, cloud credentials, browser profiles, package-manager credentials, or unrelated service sockets to the agent. 6. Apply outbound network restrictions appropriate to the task. 7. Treat repositories and prompt files from untrusted sources as potentially hostile. 8. Clearly state that `--cwd` is only a working-directory selection and must not be relied upon as filesystem confinement. 9. Where permission skipping is unavoidable, require a prominent warning and an explicit user opt-in rather than presenting it as the standard recipe.