Coding Agent Local

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 1.0.0

Overview

This skill is a coding-agent helper, but it repeatedly recommends high-privilege, low-oversight execution patterns that users should review carefully before installing.

Install only if you are comfortable with a skill that may cause your agent to launch other coding agents with broad local authority. Prefer sandboxed modes, avoid --yolo and bypassPermissions unless you explicitly authorize them for a disposable or tightly scoped workspace, review all generated commands before running them, and do not post GitHub comments, create PRs, push branches, or emit OpenClaw events without checking the content first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:23

Finding

Delegated agents are instructed to bypass permission and sandbox controls

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The Skill repeatedly recommends `--permission-mode bypassPermissions` for Claude Code and `--yolo` for Codex. The document explicitly describes `--yolo` as disabling both the sandbox and approval requirements. These modes remove controls intended to constrain delegated agents and require confirmation for security-sensitive operations. Coding agents process task prompts and repository content, both of which may be attacker-controlled. Repository instructions, issue descriptions, source comments, test fixtures, or malicious dependency scripts can therefore influence an agent operating with unrestricted access. This does not automatically grant root privileges. The resulting authority is generally limited to the operating-system acco ...[truncated 1619 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:74

Finding

Task prompts are embedded in shell command strings using unsafe quoting patterns

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The documented execution pattern embeds a task prompt inside a shell command string and attempts to delimit the prompt with single quotes. If an implementation replaces the example prompt with untrusted task text, an apostrophe in that text can terminate the quoted argument. The remaining input can then be interpreted by the shell as operators, substitutions, redirections, or additional commands. For example, prompt text shaped like the following would escape the intended argument under direct string interpolation: ```text '; attacker_command; # ``` The Markdown file does not itself execute these examples. Exploitation depends on an orchestrator or user following the documented pattern and interpolating attacker-controlled prompt content into the shell string. The risk is particularly severe where the same command also enab ...[truncated 1212 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:190

Finding

Instructions recommend unpinned global and project dependency installation

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The Skill recommends globally installing a package without an exact version and running `pnpm install` inside repositories before launching unrestricted agents. An unpinned global installation resolves a mutable package version at execution time, so the installed artifact can differ from the version originally reviewed. Project installation also processes dependency metadata controlled by the repository and may execute package lifecycle scripts. The instructions do not require a reviewed lockfile, frozen dependency resolution, integrity verification, lifecycle-script restrictions, or an isolated installation environment. The audit did not identify evidence that the named package is malicious. The vulnerability is the unsafe supply-chain execution pattern, not a claim about the current package contents. ### Attack Path 1. An attacker compromises a dependency release, gains control of a package namespace, or supplies a repository with malicious dependency metadata or lifecycle scripts. 2. An operator follows the Skill and runs the unpinned global installation or `pnpm install`. 3. The package manager resolves and downloads mutable third-party artifacts. 4. Installation or lifecycle code executes with the privileges of the invoking user. 5. Malicious code can access the installation environment before the coding agent begins its assign ...[truncated 856 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

## Codex CLI

**Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml)

### Flags

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance recommends Claude Code with --permission-mode bypassPermissions and discusses dangerous skip-permission behavior, but does not prominently warn that this disables approval checks and can allow broad file or command actions. In a coding-agent skill, that materially increases the chance of unintended destructive changes or data exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Quick Start: One-Shot Tasks

For quick prompts/chats, create a temp git repo and run:

bash

# Quick chat (Codex needs a git repo!)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation implies that setting workdir limits what the agent can access, but later examples use highly privileged modes such as --yolo and bypassPermissions that can undermine that assumption. This can mislead operators into overtrusting directory scoping and result in broader file access or unreviewed side effects.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Documenting --full-auto as auto-approving workspace changes encourages autonomous modification without human review. While less severe than unsandboxed execution, it still reduces control over code, tests, and file edits and can amplify mistakes by spawned agents.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

| Flag            | Effect                                             |
| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The --yolo mode is explicitly documented as removing both sandboxing and approval requirements, enabling autonomous high-privilege actions. In a skill designed to spawn background coding agents, this materially raises the risk of destructive file changes, command execution, and unintended remote actions without oversight.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The example actively recommends using --full-auto for building tasks, normalizing autonomous code changes as a standard workflow. This can lead users to invoke agents that modify repositories without adequate review, increasing the risk of accidental breakage or insertion of unsafe code.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Building/Creating

bash

# Quick one-shot (auto-approves) - remember PTY!
bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'"

# Background for longer work

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill goes beyond mere local code delegation by instructing the agent to clone repositories, check out PRs, push branches, and create GitHub comments/PRs. That expands the trust boundary from local coding assistance to external networked actions that can disclose data or mutate remote state if invoked without explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes a command to post review content directly to GitHub, which is external data transmission and remote-state mutation. Without a clear user-facing warning or confirmation step, sensitive review text or internal findings could be published unintentionally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

For fixing multiple issues in parallel, use git worktrees:

bash

# 1. Create worktrees for each issue
git worktree add -b fix/issue-78 /tmp/issue-78 main
git worktree add -b fix/issue-99 /tmp/issue-99 main

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The rules section endorses --full-auto for building as a blanket recommendation, reinforcing autonomous behavior without emphasizing safeguards. That broad guidance can cause operators to skip review for routine development tasks where repository integrity still matters.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

- If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over.
3. **Be patient** - don't kill sessions because they're "slow"
4. **Monitor with process:log** - check progress without interfering
5. **--full-auto for building** - auto-approves changes
6. **vanilla for reviewing** - no special flags needed
7. **Parallel is OK** - run many Codex processes at once for batch work
8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The auto-notify pattern instructs spawned agents to invoke an OpenClaw system event on completion, which is an out-of-band messaging/integration action rather than pure coding. Even if intended for usability, it creates a path for agent-generated text to influence platform messaging behavior and could be abused for spam or misleading notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The auto-notify example causes the background agent to send a system event containing completion text, but the skill does not clearly disclose that this emits information outside the agent process. This can create minor data leakage or notification abuse risks if the summary includes sensitive details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.