제출 #862629: cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285)

# Technical Details
An Improper Authorization vulnerability exists in Mercury's delegated sub-agent flow. In `src/core/sub-agent.ts`, the delegated worker unconditionally enables `autoApproveAll` and a broad temporary filesystem scope before entering its tool loop. In `src/capabilities/permissions.ts`, `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate entirely. Since `delegate_task` spawns the sub-agent using the same capability registry and preserves the caller's channel context, an attacker can route a normally approval-gated shell command through `delegate_task` to achieve silent execution via `run_command` in `src/capabilities/shell/run-command.ts`.

# Vulnerable Code
File: src/core/sub-agent.ts (lines 137-145)
Method: SubAgent.run()
Why: The delegated worker unconditionally enables `autoApproveAll` and broad temporary filesystem scope before executing tools.

File: src/capabilities/permissions.ts (lines 458-462)
Method: PermissionManager.checkShellCommand()
Why: `checkShellCommand()` immediately approves shell execution whenever `autoApproveAll` is set, skipping the normal prompt gate.

File: src/capabilities/shell/run-command.ts (lines 97-108)
Method: run_command tool handler
Why: `run_command` trusts the result of `checkShellCommand()` and then executes the attacker-influenced command in a real shell.

# Reproduction
1. Authenticate to Mercury web dashboard.
2. Send a chat prompt causing the model to invoke `delegate_task` with a shell command payload.
3. Observe the delegated sub-agent executes `run_command` without triggering any `permission_request` event.
4. Confirm the canary file is written with the expected content.
5. Verify the control path (direct `run_command`) shows `permissionRequestCount: 1` and creates no file.

# Impact
- Approval-bypass leading to arbitrary command execution in the Mercury runtime context.
- Attacker can run arbitrary shell commands with Mercury's filesystem, secrets, and host privileges.
- Can expose `.env` files, `~/.mercury` state, source code, API tokens, and local Git credentials.

• 원천: ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/75
• 사용자: ChenMarry (UID 99089)
• 제출: 2026. 06. 18. AM 09:37 (2 개월 ago)
• 모더레이션: 2026. 08. 05. PM 09:42 (2 months later)
• 상태: 중복
• VulDB 항목: 386381 [cosmicstack-labs mercury-agent 까지 1.1.12 delegate_task Tool src/core/sub-agent.ts SubAgent.run 권한 상승]
• 포인트들: 0