Security audit

Coding Agent Local

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented coding-agent launcher, but it normalizes high-authority agent modes that can run without approvals, change files, publish code, and trigger host notifications.

Install only if you intentionally want OpenClaw to launch local coding-agent CLIs with real authority over project files. Prefer sandboxed or approval-gated modes, avoid --yolo and permission-bypass settings in important repositories, use temp clones or worktrees, review changes before any commit/push/PR, and avoid putting secrets or sensitive code details in completion notifications.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs spawned agents to execute `openclaw system event`, which extends their authority from coding/delegation into host-level signaling. That creates a secondary command channel agents can use to emit messages or trigger orchestrator behavior, and the suggested summary text may carry unreviewed content from the agent back into the system.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill recommends `claude --permission-mode bypassPermissions` as the normal execution path without a prominent warning that this disables interactive safeguards. In a coding-agent context, that gives the delegated model broad ability to read, modify, and potentially execute within the target environment with little friction, increasing the chance of destructive or overbroad actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The examples normalize Codex `--yolo` usage for real tasks, and although one table says it is dangerous, the operational guidance still presents it as a standard option for refactoring and issue fixing. `--yolo` removes sandboxing and approvals, so a delegated agent can make arbitrary filesystem or command changes without checkpoints.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The completion-notification pattern instructs the agent to send a free-form summary through `openclaw system event` but does not warn that this may expose task details over a host event channel. Even if the event mechanism is legitimate, allowing agent-authored text to flow into system notifications can leak sensitive repo or task information.

Static analysis

No suspicious patterns detected.