Submit #862544: nearai IronClaw 0.29.1 Improper Authorization (CWE-285)

# Technical Details
A Shell Approval Bypass via Transparent `env`/shell Wrappers exists in the `classify_command_risk()` method in `src/tools/builtin/shell.rs` of IronClaw.

The application classifies command risk by the first visible token only, without unwrapping transparent dispatch wrappers. A destructive command wrapped in `/usr/bin/env bash -lc "rm -rf ..."` is classified from `env` instead of the effective inner payload `rm -rf`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved` instead of `Always`. When `shell` has been previously auto-approved in the session, the wrapped destructive payload skips the explicit re-confirmation that a raw `rm -rf` would require.

# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: classify_command_risk() and matches_command_pattern() — only inspect the first whitespace-delimited token per segment; ShellTool::requires_approval() maps Medium to UnlessAutoApproved
Why: The prefix-only classifier cannot see through transparent wrappers like `/usr/bin/env bash -lc`, so the effective inner destructive command is hidden from the high-risk matcher.

# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `/usr/bin/env bash -lc "rm -rf /tmp/marker"`.
2. Observe the command is classified as `Medium` (from `env`), maps to `UnlessAutoApproved`, and skips the fresh approval prompt.
3. Confirm the direct command `rm -rf /tmp/marker` is classified as `High`, maps to `Always`, and still requires approval.

# Impact
- Approval bypass allowing high-risk shell actions to avoid the explicit per-invocation confirmation floor.
- Enables prompt injection or malicious context to route destructive commands through transparent wrappers.
- Can lead to filesystem destruction, source-control damage, or chained shell-based compromise.

• Quelle: ⚠️ https://github.com/nearai/ironclaw/issues/4863
• Benutzer: Erichen-apple (UID 99087)
• Einreichung: 18.06.2026 08:38 (vor 2 Monaten)
• Moderieren: 05.08.2026 18:45 (2 months later)
• Status: Duplikat
• VulDB Eintrag: 386265 [nearai ironclaw bis 0.29.1 shell.rs classify_command_risk erweiterte Rechte]
• Punkte: 0