T05 · Unauthorized Access and Privilege Escalation
- Location
.claude/settings.local.json:2- Finding
Overly Broad Repository Mutation Permissions
- Content
View full analysis
Vulnerability Details
File Location:
.claude/settings.local.json, lines 2–9
Vulnerability Type: Excessive shell permissions that violate least privilege
Risk Level: MediumComplete Code Snippet:
json { "permissions": { "allow": [ "Bash(git init *)", "Bash(git add *)", "Bash(git rm *)", "WebFetch(domain:clawhub.ai)", "WebSearch" ] } }Technical Analysis
This project consists of documentation and AI skill instructions for strategic analysis. Its declared runtime functionality does not require shell access or repository mutation. Despite that, the local Claude configuration pre-authorizes wildcard forms of
git init,git add, andgit rm.The most significant permission is
Bash(git rm *), which permits destructive removal of arbitrary repository paths accepted by the command pattern.Bash(git add *)can also stage unintended files, including locally generated or sensitive material that is not properly excluded. Wildcard authorization reduces opportunities for user review and permits command arguments that are much broader than the Skill's legitimate requirements.Attack Path
- A user or untrusted document supplies instructions that induce the agent to alter repository contents.
- The agent operates with the project-local permissions from
.claude/settings.local.json. - The agent invokes a pre-authorized command such as
git rm <path>orgit add <path>. - Tracked files are removed from the working tree and index, or unintended files are staged, without a new command-specific permission decision.
- A later commit or automated workflow may preserve or propagate the unwanted change.
This path depends on an agent honoring the local permission configuration and being induced to issue one of the allowed commands; the configuration itself does not automatically execute commands.
Impact Assessment
The permissi ...[truncated 699 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the
Bash(git init *),Bash(git add *), andBash(git rm *)entries from the distributed project configuration because they are unnecessary for the Skill's documented operation. - Require explicit, per-command confirmation for destructive operations such as
git rm. - If repository maintenance permissions are needed during development, place them in an untracked, developer-specific configuration rather than shipping them with the Skill.
- Replace wildcard permissions with narrowly scoped commands and fixed paths wherever automation is unavoidable.
- Add pre-operation checks that display the exact affected paths and reject paths outside the intended project scope.
- Ensure sensitive and generated files are covered by
.gitignore, while recognizing that ignore rules are not a substitute for restrictinggit add. - Review project-local agent permissions as part of release checks and enforce least privilege by default.
- Remove the