Security audit

CodeBuddy Coding

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real CodeBuddy coding wrapper, but it needs review because it defaults to permission bypass while running a CLI that can modify files and execute commands.

Install only if you trust the separate CodeBuddy CLI and intend to give it broad coding authority. Use it in a version-controlled or disposable workspace, pass an explicit safe cwd, avoid bypassPermissions unless deliberately needed, do not feed it untrusted task text, and monitor or disable detached background execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The README explicitly documents a `permissionMode` option that includes `bypassPermissions` for a general coding skill, but provides no restriction, approval workflow, or narrowly scoped maintenance purpose. In an agent context, normalizing permission bypass can lead to unreviewed file modifications or execution with elevated access beyond what users expect.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The example for an `ArchitectAgent` actively encourages use of `permissionMode: 'bypassPermissions'` for routine scaffold generation, which is not a sufficiently justified reason to disable safeguards. Because examples shape real integrations, this can directly cause downstream agents to adopt elevated-permission behavior by default.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The wrapper is not merely parsing output: it actively executes CodeBuddy tasks and defaults to '--permission-mode bypassPermissions', which can suppress safeguards while allowing the underlying CLI to modify files in the chosen working directory. In a skill/agent context, this increases the risk of unauthorized code changes, destructive actions, or execution of dangerous tool operations from untrusted prompts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README describes both permission bypass and file-modifying behavior, yet does not warn users that invoking the skill may alter project files with elevated privileges. In agent ecosystems, lack of disclosure increases the chance that operators will enable risky behavior without understanding the consequences.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This example demonstrates `bypassPermissions` with no accompanying warning, making elevated access appear normal and safe for common development tasks. In practice, users or agent authors may copy this snippet verbatim, leading to over-privileged automation that can overwrite sensitive files or bypass intended safety checks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises file operations including deletion and arbitrary command execution as core capabilities, but the documentation does not prominently warn users about data loss, destructive actions, or host-system impact. In an agent skill context, normalizing these capabilities without safety guidance increases the chance that downstream agents or operators invoke dangerous actions on real projects or systems.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The examples explicitly recommend using `permissionMode: 'bypassPermissions'` and show the equivalent CLI flag without any warning, which encourages operators and integrators to disable built-in safeguards by default. In an agent-driven coding skill, this materially increases the risk of unauthorized file changes, destructive shell actions, and broader compromise of the local environment.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The wrapper supports detached background execution without any built-in warning, approval gate, or visibility to the caller that a long-lived subprocess may continue operating after control returns. In an agent setting, this can hide persistent or unexpected activity, making malicious or erroneous file changes harder to notice and stop.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill defaults `permissionMode` to `bypassPermissions`, causing tasks to run with elevated autonomy unless the caller explicitly overrides it. In a coding-agent context that may execute file modifications or external tool actions, this weakens safety boundaries and increases the chance of unauthorized changes, destructive actions, or abuse if untrusted task input reaches the CLI.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description 'Universal AI coding skill powered by CodeBuddy CLI' is extremely broad and does not meaningfully constrain when the skill should be selected. In a system with tool-routing or automatic skill invocation, this can cause the skill to be chosen for tasks beyond its intended scope, increasing exposure to risky capabilities like file operations and command execution.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli-wrapper.js:23