提出 #862628: cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285)

# Technical Details
An Improper Authorization vulnerability exists in Mercury's sub-agent execution path. The `delegate_task` tool accepts an `allowedTools` array (e.g., `['read_file']`) and forwards it into sub-agent creation, creating the expectation of a narrowed capability set. However, at execution time in `src/core/sub-agent.ts`, `SubAgent.run()` always passes the full registry returned by `this.capabilities.getTools()` into the AI SDK loop, ignoring the `allowedTools` restriction. The registry includes orchestration tools (`list_agents`, `stop_agent`) whenever a supervisor exists. Additionally, `stop_agent` in `src/capabilities/subagents/stop-agent.ts` halts any target via `supervisor.halt(agentId)` without checking ownership or allowed-tool constraints.

# Vulnerable Code
File: src/core/sub-agent.ts (lines 167-173)
Method: SubAgent.run()
Why: The child execution loop always receives the full `capabilities.getTools()` registry, ignoring the declared `allowedTools` restriction.

File: src/capabilities/registry.ts (lines 241-245)
Method: CapabilityRegistry constructor
Why: Registry exposes `delegate_task`, `list_agents`, and `stop_agent` whenever a supervisor is present, making orchestration tools available to restricted children.

File: src/capabilities/subagents/stop-agent.ts (lines 13-27)
Method: createStopAgentTool()
Why: `stop_agent` halts the requested target via `supervisor.halt(agentId)` without checking whether the caller owns or is allowed to control that target agent.

# Reproduction
1. Deploy Mercury with sub-agent delegation enabled.
2. Create a restricted child sub-agent with `allowedTools=['read_file']`.
3. Observe the child still receives `list_agents` and `stop_agent` in its tool registry.
4. The child uses `list_agents` to identify a sibling, then halts it via `stop_agent`.
5. Confirm the control case (benign child) performs only `read_file` without halting siblings.

# Impact
- Authorization and privilege-scope bypass in delegated sub-agent orchestration.
- Restricted child agents can enumerate and halt sibling sub-agents.
- Invalidates the security assumption that `allowedTools` meaningfully constrains delegated workers.

• ソース: ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/74
• ユーザー: ChenMarry (UID 99089)
• 送信: 2026年06月18日 09:37 (2 月 ago)
• モデレーション: 2026年08月05日 21:42 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 386381 [cosmicstack-labs mercury-agent 迄 1.1.12 delegate_task Tool src/core/sub-agent.ts SubAgent.run 特権昇格]
• ポイント: 20