[CRITICAL] Dangerous permissions bypassed in agent mode

[Tsukieomie]

Security Issue: Permission Bypass in Agent Mode

Severity: CRITICAL
Location: src/main/lib/trpc/routers/claude.ts:1056

Description

Claude Code SDK is configured with allowDangerouslySkipPermissions: true in agent mode, allowing full system access without user prompts.

Code

...(input.mode !== "plan" && {
  allowDangerouslySkipPermissions: true,  // ⚠️ DANGEROUS!
}),

Risk

• Claude Code SDK executes ANY tool without permission warnings
• Full system access (file writes, bash commands, network requests)
• No user oversight on potentially destructive operations

Recommendation

1. Add user confirmation dialogs for sensitive operations:
   • File writes outside project directory
   • Bash commands with sudo/destructive flags
   • Network requests
   • Git operations (push, force-push, etc.)
2. Implement a permission whitelist system
3. Add audit log for all agent actions
4. Consider tiered permission levels (safe/moderate/dangerous)

Impact

High - Users may inadvertently allow destructive operations without realizing the full scope of agent permissions.

Labels: security, critical, agent-mode

[thomas-goshaka]

I agree, when testing the application I noticed it never asked for permission for commands and then found this issue when I wanted to report it.
I do not feel comfortable using the product with this allowed.
Preferably this would be a setting that is turned off by default for all users.