T05 · Unauthorized Access and Privilege Escalation
- Location
references/agent-usage.md:8- Finding
Unrestricted Unattended Agent Execution
- Content
View full analysis
Vulnerability Details
File Location:
references/agent-usage.md, lines 8–11
Vulnerability Type: Permission controls disabled for an unbounded autonomous execution loop
Risk Level: HighVulnerable Code
bash while :; do claude --print --dangerously-skip-permissions \ "Read prd.json, find first story where passes=false, implement it, run checks, update passes=true if successful" doneTechnical Analysis
The documented command launches an autonomous coding agent with
--dangerously-skip-permissions, explicitly disabling permission checks. It also useswhile :, creating an unbounded loop with no iteration limit, error threshold, lack-of-progress detection, or mandatory human review.The agent reads
prd.jsonand operates on the surrounding project. Because those inputs and the repository context may be attacker-controlled, compromised, or simply erroneous, the agent could be induced to execute commands or modify files without approval. The process inherits the invoking user's accessible files, credentials, tools, network access, and repository permissions.This violates least privilege and exceeds the skill's declared PRD-editing purpose. The absence of a bounded stop mechanism also creates a denial-of-service risk if stories remain incomplete or completion status cannot be persisted.
Attack Path
- An attacker gains the ability to modify
prd.json, referenced project files, or other repository content consumed by the coding agent. - The attacker adds a story or contextual instruction that induces sensitive file access, destructive commands, unauthorized source changes, credential use, or other harmful operations.
- A user follows the documented example and launches the loop with
--dangerously-skip-permissions. - The agent processes the attacker-controlled repository context without requesting permission for sensitive operations.
- Commands and file modifications run with the privileges and accessible resour ...[truncated 852 chars]
- An attacker gains the ability to modify
- Remediation
View remediation
Remediation Suggestions
- Remove
--dangerously-skip-permissionsand retain normal approval controls for command execution, file access, network activity, and other sensitive operations. - Run the agent in a restricted sandbox or container with:
- A dedicated unprivileged account.
- Access limited to the intended worktree.
- No access to SSH keys, cloud credentials, tokens, or unrelated user files.
- Network access disabled by default or restricted to an explicit allowlist.
- Replace
while :with a bounded loop that enforces:- A maximum number of iterations.
- A wall-clock timeout.
- Immediate termination after command or validation failures.
- Detection of repeated failures and lack of progress.
- Validate the PRD structure and constrain actionable fields before execution. Treat PRD text and repository content as untrusted input rather than authoritative operational instructions.
- Require human review before running migrations, installing dependencies, accessing secrets, executing destructive commands, pushing changes, or merging commits.
- Use a clean Git worktree and inspect the resulting diff before accepting or publishing changes.
- Document an emergency stop procedure and log every command, file modification, and permission-sensitive operation performed by the agent.
- Remove