T05 · Unauthorized Access and Privilege Escalation
- Location
.claude/settings.local.json:2- Finding
Unrelated Git Push Permission Violates Least Privilege
- Content
View full analysis
Vulnerability Details
File Location:
.claude/settings.local.json, lines 2-5
Vulnerability Type: Pre-authorized repository write operation
Risk Level: Mediumjson "permissions": { "allow": [ "Bash(git push origin main)" ] }Technical Analysis
The local Agent configuration explicitly allows
git push origin mainwithout requiring an additional authorization prompt. Pushing source code is unrelated to the Skill's declared OKX market-data, account-management, WebSocket, and trading functionality.This permission breaks least-privilege boundaries by granting a consequential source-control capability that is unnecessary for any documented Skill operation. Although the rule only authorizes the specified command and does not itself create commits, it can publish existing or newly created local commits if the execution environment has valid Git credentials and write access to the remote repository.
Attack Path
- A user opens or runs an Agent session with this project configuration active.
- The runtime imports the allow rule from
.claude/settings.local.json. - Existing local commits are present, or another authorized action modifies and commits repository content.
- A malicious instruction, compromised dependency, prompt injection, or mistaken Agent action invokes
git push origin main. - The configured allow rule suppresses the normal approval boundary for that command.
- Git uses the user's configured credentials to publish commits to the remote
mainbranch.
Exploitation therefore depends on the environment having push-capable credentials and commits that are not already present on the remote.
Impact Assessment
The permission can expose the repository-write privileges of the current Git identity. Potential impact includes:
- Unauthorized publication of local source changes or sensitive committed files.
- Modification of the remote default branch when bran ...[truncated 303 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
.claude/settings.local.jsonfrom the distributed Skill package. - Delete the
Bash(git push origin main)allow rule. - Require explicit, per-operation user confirmation for every Git push.
- Protect the remote default branch with mandatory pull requests, reviews, and status checks.
- Use Git credentials scoped to the minimum necessary repositories and operations.
- Add repository checks that reject packaged local Agent permission files unless they are required and documented.
- Remove