Critical Vulnerabilities
Each critical must be resolved before its associated phase ships. No exceptions.
CRITICAL-1
Hook Command Injection
Unsanitized file paths passed as shell arguments become metacharacters. A file named ; rm -rf / executes arbitrary commands.
CRITICAL-2
Rule-Based Prompt Injection
Cloned repo ships crafted alwaysApply: true rules in project config. Rules become part of system prompt, manipulating agent behavior.
CRITICAL-3
Memory Secrets Leakage
Prompt injection writes malicious instructions or API keys to persistent memory. Facts persist across sessions, creating permanent compromise.
CRITICAL-4
MCP Untrusted Server Instructions
Project-level MCP config with a command field is arbitrary code execution via repo cloning. Server instructions can also inject into the agent’s system prompt.
Remediation Roadmap
12 remediation items ordered by phase dependency. Each item blocks its associated feature from shipping.
Trust Boundary Model
Five trust levels governing how input from each source is processed by the agent.
Additional Security Findings
5 High-severity and 6 Medium-severity findings from the 10-agent review.
HIGH-1: Subagent Tool Access
Default subagent gets full tools including bash. Read-only agents must spawn without bash, edit, or write.
HIGH-2: Git Worktree Shared State
Subagents in worktrees can modify .git/hooks/, run git gc, delete branches. Filter destructive git operations.
HIGH-3: updatedInput Escalation
Hook returning updatedInput can rewrite bash command or edit file_path outside project. Restrict mutations.
HIGH-4: TTSR Cascade DoS
Broad regex in project-level ttsrTrigger forces constant retries. Reject project-level TTSR. Cap retries at 3.
HIGH-5: Hook R4 Override
Hook approve decision bypasses risk-based authorization. Hooks cannot override destructive classification.
MEDIUM-1: Env Override
SUBQ_SYSTEM_INSTRUCTIONS_FILE bypasses all safety rules. Log warning when active.
MEDIUM-2: Orphan Timeout
5-minute orphan subagent with bash access. Reduce to 60 seconds.
MEDIUM-3: API Key Inheritance
Child processes inherit OPENROUTER_API_KEY. Strip from hook/subagent/MCP env.
MEDIUM-4: Memory Lock Race
Manual write + autonomous extraction race on MEMORY.md. Use rename-based atomic writes.
MEDIUM-5: TTY-Based Autonomy
process.stdout.isTTY is spoofable. Focus detection should modulate verbosity, never permission level.
MEDIUM-6: Cross-Project Leak
Resuming project A’s session in project B may reference proprietary code. Strip tool output on cross-project resume.