提出 #862629: cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285)

# Technical Details
An Improper Authorization vulnerability exists in Mercury's delegated sub-agent flow. In `src/core/sub-agent.ts`, the delegated worker unconditionally enables `autoApproveAll` and a broad temporary filesystem scope before entering its tool loop. In `src/capabilities/permissions.ts`, `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate entirely. Since `delegate_task` spawns the sub-agent using the same capability registry and preserves the caller's channel context, an attacker can route a normally approval-gated shell command through `delegate_task` to achieve silent execution via `run_command` in `src/capabilities/shell/run-command.ts`.

# Vulnerable Code
File: src/core/sub-agent.ts (lines 137-145)
Method: SubAgent.run()
Why: The delegated worker unconditionally enables `autoApproveAll` and broad temporary filesystem scope before executing tools.

File: src/capabilities/permissions.ts (lines 458-462)
Method: PermissionManager.checkShellCommand()
Why: `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate.

File: src/capabilities/shell/run-command.ts (lines 97-108)
Method: run_command tool handler
Why: `run_command` trusts the result of `checkShellCommand()` and then executes the attacker-influenced command in a real shell.

# Reproduction
1. Authenticate to Mercury web dashboard.
2. Send a chat prompt causing the model to invoke `delegate_task` with a shell command payload.
3. Observe the delegated sub-agent executes `run_command` without triggering any `permission_request` event.
4. Confirm the canary file is written with the expected content.
5. Verify the control path (direct `run_command`) shows `permissionRequestCount: 1` and creates no file.

# Impact
- Approval-bypass leading to arbitrary command execution in the Mercury runtime context.
- Attacker can run arbitrary shell commands with Mercury's filesystem, secrets, and host privileges.
- Can expose `.env` files, `~/.mercury` state, source code, API tokens, and local Git credentials.

• ソース: ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/75
• ユーザー: ChenMarry (UID 99089)
• 送信: 2026年06月18日 09:37 (2 月 ago)
• モデレーション: 2026年08月05日 21:42 (2 months later)
• ステータス: 重複
• VulDBエントリ: 386381 [cosmicstack-labs mercury-agent 迄 1.1.12 delegate_task Tool src/core/sub-agent.ts SubAgent.run 特権昇格]
• ポイント: 0