提出 #862546: nearai IronClaw 0.29.1 Improper Authorization (CWE-285)

# Technical Details
A Shell Approval Boundary Bypass via `env /bin/sh -c` Wrapper exists in the command risk classifier in `src/tools/builtin/shell.rs` of IronClaw.

The application classifies command risk by the visible outer token and does not unwrap transparent shell dispatch wrappers. A destructive payload wrapped as `env /bin/sh -c 'chmod 777 /tmp/demo'` is classified from `env`, not from the inner `chmod 777`. The classifier returns `RiskLevel::Medium`, which maps to `ApprovalRequirement::UnlessAutoApproved`. When `shell` has been previously auto-approved in the session, the wrapped destructive command bypasses the per-invocation check and executes through `sh -c`. Direct destructive commands still hit the `Always` floor.

# Vulnerable Code
File: src/tools/builtin/shell.rs
Method: classify_command_risk() — classifies from outer token `env` without unwrapping `/bin/sh -c`; ShellTool::requires_approval() maps both Low and Medium to UnlessAutoApproved
File: src/agent/dispatcher.rs and src/agent/thread_ops.rs
Method: Approval logic skips UnlessAutoApproved when session has auto-approved shell, preserving Always only as the per-call floor
Why: The outer-to-inner wrapper chain is invisible to the prefix classifier, and the approval model trusts the misclassified risk level. Once shell is auto-approved, any UnlessAutoApproved command executes without re-confirmation.

# Reproduction
1. In an IronClaw session with `shell` previously auto-approved, send: `env /bin/sh -c 'chmod 777 /tmp/demo'`.
2. Observe the command is classified as `Medium`, maps to `UnlessAutoApproved`, and skips the fresh approval.
3. Confirm the direct `chmod 777 /tmp/demo` is classified as `High`, maps to `Always`, and still requires approval.

# Impact
- Approval bypass allowing destructive shell behavior (permission changes, file operations) without the intended second approval step.
- Malicious prompt content or prompt-injected context can hide destructive commands behind transparent wrappers.
- Follow-on shell command execution within IronClaw runtime privileges or sandbox/container context.

• ソース: ⚠️ https://github.com/nearai/ironclaw/issues/4865
• ユーザー: Erichen-apple (UID 99087)
• 送信: 2026年06月18日 08:42 (2 月 ago)
• モデレーション: 2026年08月05日 18:46 (2 months later)
• ステータス: 重複
• VulDBエントリ: 386265 [nearai ironclaw 迄 0.29.1 shell.rs classify_command_risk 特権昇格]
• ポイント: 0