T05 · Unauthorized Access and Privilege Escalation
- Location
references/agent-usage.md:7- Finding
Unattended Agent Loop Disables Permission Controls
- Content
View full analysis
Vulnerability Details
File Location:
references/agent-usage.md, lines 7-11
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: HighVulnerable Code:
bash ### Claude Code ```bash while :; do claude --print --dangerously-skip-permissions \ "Read prd.json, find first story where passes=false, implement it, run checks, update passes=true if successful" doneTechnical Analysis
The documented workflow repeatedly starts an autonomous coding agent with
--dangerously-skip-permissions. This explicitly removes interactive permission enforcement while directing the agent to derive executable work from the mutableprd.jsonfile.The infinite
while :loop has no iteration limit, failure threshold, or built-in safe termination condition. Although the project describes itself as a PRD authoring Skill, this workflow delegates repository and potentially system-level operations to an unattended agent. The effective privileges depend on the account, credentials, filesystem access, and tool configuration available to the Claude process.Because PRD user stories and acceptance criteria are treated as instructions, anyone able to influence
prd.jsonmay insert tasks that cause the agent to execute commands or modify files beyond legitimate PRD management. The documented workflow does not require task validation, command restrictions, sandboxing, or human approval before those actions occur.Attack Path
- A user follows the documented unattended-agent workflow from a repository with locally available credentials and development tools.
- An attacker, compromised dependency, malicious contributor, or other untrusted process modifies
prd.jsonand adds an incomplete story containing harmful implementation requirements. - The loop launches Claude with
--dangerously-skip-permissions. - Claude reads the attacker-influenced story and attempts to implement it ...[truncated 1343 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--dangerously-skip-permissionsfrom all recommended commands and retain interactive authorization for sensitive tool calls. - Replace the infinite loop with a bounded, single-story invocation. Require explicit human review and approval before starting each subsequent story.
- Stop immediately when validation fails, the agent encounters an unexpected instruction, or the configured iteration and time limits are reached.
- Run autonomous agents inside an isolated container or restricted worktree with:
- Access limited to the intended repository.
- No mounted home directory or credential stores.
- Minimal environment variables.
- Restricted outbound network access.
- A non-privileged operating-system account.
- Validate
prd.jsonagainst a strict schema before use. Enforce field lengths and allowed values, and reject stories containing shell commands, credential-access requests, permission changes, or unrelated filesystem paths. - Treat all PRD text as untrusted data rather than higher-priority agent instructions. Use a fixed trusted execution prompt that explicitly prohibits following embedded instructions outside the approved story scope.
- Require human review of diffs, migrations, generated commands, and commits before applying them to the main branch or shared infrastructure.
- Provide a safe stop condition that checks whether all stories are complete and exits after a defined maximum number of iterations.
- Use separate, narrowly scoped credentials for test services and prevent autonomous access to production systems.
- Document that unattended execution is unsafe for repositories or PRDs that may be influenced by untrusted contributors.
- Remove