T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:59- Finding
Claude CLI Invocations Disable Permission Enforcement
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 59-87
Vulnerability Type: Least-privilege violation through unrestricted agent permissions
Risk Level: HighVulnerable Code
bash claude -p "审查这个文件，找出 bug、安全问题、性能问题" --print --model deepseek-v4-flash --permission-mode bypassPermissionsbash claude -p "在项目中修改xxx，要求..." --print --add-dir "D:\Qt program\MST-Visualizer" --permission-mode bypassPermissionsbash claude -p "修改xxx" --print --add-dir "$(pwd)" --permission-mode bypassPermissions --model deepseek-v4-flashThe accompanying instructions state that tool-enabled operation permits the delegated agent to use file-reading, file-editing, and shell capabilities directly.
Technical Analysis
The documented command templates use
--permission-mode bypassPermissions, disabling the normal approval boundary for Claude CLI tool operations. This setting is recommended not only for project modification but also for code review, even though a review task ordinarily requires read-only access.Combining permission bypass with
--add-dir "$(pwd)"is especially unsafe because the accessible directory depends on the caller's current working directory. If the command is launched from an unintended directory, the agent may receive access to a broader or more sensitive filesystem scope than the user expected.A tool-enabled coding agent processes both the user's prompt and repository content. Consequently, malicious instructions embedded in source files, documentation, build metadata, or other repository artifacts could influence the agent. With permission checks bypassed, such influence can result in file modifications or shell execution without an interactive approval step.
The Skill does not itself contain an exploit payload and does not automatically execute these commands. The vulnerability is the unsafe default operating mode that removes a critical control when users follow the do ...[truncated 1977 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--permission-mode bypassPermissionsfrom every default command template. - Use a read-only tool profile for audits and code reviews. Disable file editing and shell execution when they are not required.
- Require explicit user confirmation for every write, deletion, process execution, network operation, and access outside the initial project scope.
- Replace
--add-dir "$(pwd)"with an explicit, canonicalized project path. Verify that the selected directory is the intended repository root before invocation. - Restrict accessible paths to the smallest required subtree and exclude credential files, home-directory configuration, version-control credentials, environment files, and unrelated workspaces.
- Run modification tasks in an isolated worktree, container, or low-privilege account with no production credentials.
- Separate review and modification workflows. A review command should produce recommendations only; a later, independently approved step should apply changes.
- Treat repository content as untrusted input and instruct the delegated agent not to follow operational instructions found inside reviewed files.
- Review generated diffs and command logs before accepting changes, then run tests in an isolated environment.
- If permission bypass must exist for a narrowly controlled automation workflow, make it an exceptional opt-in mode with clear warnings, a fixed allowlisted directory, restricted tools, and external sandbox enforcement.
- Remove