T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:105
- Finding
- Untrusted Linear Tasks Can Trigger Broad Agent Actions and Automated Git Pushes<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:105-119`, `SKILL.md:151-158`, and `SKILL.md:192-200` **Vulnerability Type**: Insufficient authorization and execution controls for externally supplied tasks **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:105-119`: ```text When a task arrives, the Agent processes it according to the following workflow: Task arrives (Linear Todo state) ↓ Step 1: Confirm receipt (reply notification) ↓ Step 2: Send a DM notification to the user ↓ Step 3: Update status to In Progress ↓ Step 4: Execute the task (dispatch by type) ↓ Step 5: Update status to Done + add result comment ↓ Step 6: Synchronize with Git (if enabled) ``` `SKILL.md:151-158`: ```bash # Automatically commit after task completion git add research/topic.md git commit -m "task: ENG-123 - User behavior analysis research" git push ``` `SKILL.md:192-200` defines task classes that include code modification and script execution: ```markdown | Task Type | Processing Method | Output Location | |----------|----------|----------| | Research | Spawn a sub-agent to research and generate a report | `research/[topic].md` | | Content creation | Generate a draft or completed document | `content/[name].md` | | Code task | Write or modify code and commit changes | Corresponding code repository | | Data processing | Run scripts and output results | `output/[task].json` | | Custom | Follow the user-defined output pattern | Custom path | ``` ### Technical Analysis The documented workflow accepts tasks originating from Linear through a Make.com webhook and directs the agent to execute those tasks, including code changes, script execution, custom output generation, and Git synchronization. The instructions do not define: - Webhook request authentication or signature verification. - Authorization checks for the Linear issue creator or modifier. - A task-type or command allowlist. - Repository, branch, directory, or file restrict ...[truncated 2581 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Authenticate every webhook request** - Require a cryptographic signature or shared-secret HMAC. - Validate timestamps and unique event identifiers to prevent replay. - Reject unsigned, expired, duplicated, or malformed events. 2. **Authorize the task origin** - Allowlist approved Linear teams, projects, users, and service accounts. - Fetch the issue directly from Linear after receiving an event rather than trusting forwarded fields alone. - Verify the current issue state, creator, and relevant labels before processing. 3. **Treat issue content as untrusted data** - Never interpret issue text as system-level agent instructions. - Parse tasks into a constrained schema with fixed operation types and validated parameters. - Reject requests for arbitrary shell commands, credential access, security-control changes, or unrelated filesystem operations. 4. **Restrict execution privileges** - Run work in an isolated container or sandbox with no unnecessary host access. - Use a dedicated low-privilege operating-system account. - Restrict filesystem access to a designated workspace. - Disable network access unless explicitly required for an approved task. 5. **Constrain Git operations** - Use a dedicated repository-scoped credential with no administrative permissions. - Push only to a designated temporary branch. - Require a pull request and human review before merging. - Prohibit direct pushes to protected or deployment branches. - Stage only explicitly approved paths rather than broad or dynamically selected files. 6. **Require approval for sensitive actions** - Add mandatory approval before script execution, code changes, status completion, and every remote Git push. - Present the proposed command, changed files, diff, destination repository, and branch to the reviewer. 7. **Add validation and monitoring** - Canonicalize and validate all output paths to prevent wor ...[truncated 216 chars]