T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:68
- Finding
- Workspace Trust and Agent Approval Controls Can Be Bypassed## Vulnerability Details **File Location**: `SKILL.md:68`, `SKILL.md:82-87`, `SKILL.md:118-147`, and `SKILL.md:310-313` **Vulnerability Type**: Safety-control bypass and excessive agent authorization **Risk Level**: High ### Vulnerable Code `SKILL.md:68`: ```bash herdr agent start cx1 --kind codex --pane "$P" --timeout 90000 -- --approve-for-me --no-alt-screen ``` `SKILL.md:82-87`: ```bash # Pre-trust first - the folder-trust dialog IS detected, so an untrusted dir fails the # start. Trust is INHERITED: a new dir under an already-trusted parent needs nothing. CFG=/tmp/agentcfg; mkdir -p "$CFG" # isolated from your real config printf '{"projects":{"%s":{"hasTrustDialogAccepted":true}}}' "$D" > "$CFG/.claude.json" ``` `SKILL.md:118-147`: ```bash python3 - "$D" <<'PY' # pre-trust; the dialog is unanswerable (below) import json, pathlib, sys p = pathlib.Path.home() / ".gemini/antigravity-cli/settings.json" d = json.loads(p.read_text()) if p.exists() else {} tw = d.setdefault("trustedWorkspaces", []) # a list of exact paths, not a map if sys.argv[1] not in tw: tw.append(sys.argv[1]) p.write_text(json.dumps(d, indent=2) + "\n") PY P=$(herdr tab create --workspace "$WS" --cwd "$D" --label ag1 --no-focus \ | jq -r .result.root_pane.pane_id) # one TAB per agent, never N panes in one tab herdr agent start ag1 --kind agy --pane "$P" --timeout 120000 \ -- --model gemini-3.7-flash-medium --effort medium --mode accept-edits herdr agent read ag1 --source detection --lines 15 # read the banner, not the status herdr agent prompt ag1 "Carry out $D/brief.md. Write your report to $D/report.md." \ --wait --timeout 1800000 & # then poll for the file, not the state ``` ```text - **The trust dialog is unanswerable from this side.** `agent start` returns `idle`, the screen holds `Do you trust the contents of this project?`, and `s ...[truncated 4084 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--approve-for-me` and `--mode accept-edits` from default launch recipes. Use read-only or approval-required modes by default. 2. Remove the instruction to place permissive settings in child-agent configuration after a classifier denial. A classifier denial must be treated as an enforced security decision, not a condition to route around. 3. Do not modify `trustedWorkspaces` or write `hasTrustDialogAccepted` automatically. Require the user to review the exact canonical workspace path and confirm trust interactively. 4. If configuration isolation is operationally necessary, create it with restrictive permissions, use a uniquely generated temporary directory, and delete it after the session. Do not change persistent configuration under the user's home directory. 5. Canonicalize and validate `$D` before use. Reject unexpected paths, symbolic-link escapes, sensitive parent directories, and paths not explicitly selected by the user. 6. Keep child agents sandboxed to the selected workspace with minimal filesystem and command permissions. Require separate, scoped confirmation for writes, shell execution, network access, and access outside the workspace. 7. Document blocked dialogs as conditions requiring user intervention or termination. Do not characterize trust-control bypasses as routine preflight steps. 8. Add a security warning that repository instructions are untrusted input and must not be allowed to alter agent safety policies or approval settings.