claude-bot
e643533141
Closes gitea issue #197. The update-audit agent fetches untrusted third-party release pages via WebFetch/WebSearch and its Write output is posted verbatim to a public Gitea issue, so injected content in a fetched page could try to redirect the agent's behavior. Harden the tool surface (verified empirically against the pinned Claude Code CLI): - Drop WebSearch: it cannot be domain-scoped like WebFetch, and the prompt already gives explicit source URLs or a well-known registry for everything it needs to look up. - Add ci/agents/update-audit/settings.json (loaded via --settings) that denies Read on /proc, /root, /home, /etc, and the repo's own .git/ — closing the credential-file and env-var-dump read paths a prompt-injected instruction could otherwise try. Verified this deny mechanism actually blocks reads, unlike Write path-scoping, which was tested and found NOT enforced under --permission-mode acceptEdits (documented in the pipeline comment; a full WebFetch domain allowlist was also considered and rejected, since Helm chart lookups legitimately hit whichever domain each HelmRelease's own trusted source URL points at). - prompt.md now tells the agent fetched content is untrusted data, not instructions, and to never echo it verbatim into the report. Not fixed here: GITEA_TOKEN is still the broad registry/release-writing token (no write:issue-only token exists yet) — that requires an operator to mint one; tracked via a comment on #197 and a code comment at the secret binding.
21 lines
897 B
JSON
21 lines
897 B
JSON
{
|
|
"//": "Read sandbox for the update-audit agent (gitea issue #197). The agent",
|
|
"//2": "fetches untrusted third-party release pages, so its Read tool is denied",
|
|
"//3": "access to anything that could hold credentials: the container's /proc",
|
|
"//4": "(env var dumps via /proc/self/environ), /root and /home (SSH keys,",
|
|
"//5": ".netrc, git-credential stores), /etc, and the repo's own .git/ (which",
|
|
"//6": "can carry an embedded clone token). Everything under the repo checkout",
|
|
"//7": "itself stays readable, which is all this agent's job requires.",
|
|
"//8": "Verified empirically against Claude Code 2.1.207: relative deny globs",
|
|
"//9": "anchor to the pipeline's cwd (repo root), not this file's directory.",
|
|
"permissions": {
|
|
"deny": [
|
|
"Read(//proc/**)",
|
|
"Read(//root/**)",
|
|
"Read(//home/**)",
|
|
"Read(//etc/**)",
|
|
"Read(.git/**)"
|
|
]
|
|
}
|
|
}
|