T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:19- Finding
Claude Code Is Launched with Permission Checks Disabled
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-24 and 167-170
Vulnerability Type: Permission-control bypass in delegated agent execution
Risk Level: HighVulnerable Code
markdown For **Claude Code** (`claude` CLI), use `--print --permission-mode bypassPermissions` instead. `--print` mode keeps full tool access and avoids interactive confirmation: ```bash # Claude Code (no PTY needed) cd /path/to/project && claude --permission-mode bypassPermissions --print 'Your task'text The unsafe mode is repeated in the standard execution examples: ```markdown ```bash # Foreground bash workdir:~/project command:"claude --permission-mode bypassPermissions --print 'Your task'" # Background bash workdir:~/project background:true command:"claude --permission-mode bypassPermissions --print 'Your task'"text ### Technical Analysis The skill makes `--permission-mode bypassPermissions` the required default for Claude Code. According to the skill itself, this mode retains full tool access while avoiding interactive confirmation. Consequently, commands selected by the delegated agent are not subjected to normal per-operation authorization checks. Coding agents process repository files, task descriptions, issue content, and generated tool output as contextual instructions. If any such content is attacker-controlled, it can attempt to redirect the agent into reading unrelated files, accessing credentials, invoking system commands, modifying files outside the intended task, or transmitting information through available network tools. Disabling confirmations removes an important security boundary that could otherwise interrupt these operations. Merely using a focused working directory does not establish a filesystem or process sandbox. Unless external enforcement exists, a process can potentially address parent directories, absolute paths, environment variables, user configuration, a ...[truncated 1429 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
--permission-mode bypassPermissionsfrom the required and example invocation patterns. - Use the normal permission mode and require explicit approval for shell execution, network access, sensitive file reads, and writes outside the project.
- Run delegated agents inside a real sandbox or container with the project mounted as the only writable path.
- Provide only narrowly scoped, short-lived credentials required for the current task; do not inherit the user's complete environment.
- Disable network access by default and permit only explicitly required destinations.
- Treat repository text, issue descriptions, and generated content as untrusted data rather than authoritative execution instructions.
- If unattended operation is necessary, define an explicit allowlist of permitted commands and paths instead of bypassing all permission checks.
- Record commands, file accesses, and network operations in an audit log, and review changes before they are committed or pushed.
- Remove