Depends on: Phase 1 (PR)
--dangerously-skip-permissions is always passed to Claude, and at the default "moderate" security level the disallow list is empty, so all tools are available with no restrictions. The classifyThreadIntent function spawns Claude with no security args, making it a tool-unrestricted execution path driven by user-controlled text. The LLM-driven "fire" path can delete Discord channels based on attacker-controlled message content (finding #18).
Changes:
- Rewrite
buildSecurityArgs so each security level enforces a real tool allowlist
- Apply security args to
classifyThreadIntent; wrap its input with wrapUntrusted
- Gate or remove LLM-driven channel deletion (slash command or confirmation step)
Depends on: Phase 1 (PR)
--dangerously-skip-permissionsis always passed to Claude, and at the default "moderate" security level the disallow list is empty, so all tools are available with no restrictions. TheclassifyThreadIntentfunction spawns Claude with no security args, making it a tool-unrestricted execution path driven by user-controlled text. The LLM-driven "fire" path can delete Discord channels based on attacker-controlled message content (finding #18).Changes:
buildSecurityArgsso each security level enforces a real tool allowlistclassifyThreadIntent; wrap its input withwrapUntrusted