coding-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

This skill is a coding-agent launcher, but it recommends unattended and permission-bypassing modes that can run commands or change files without enough user review.

Review this skill carefully before installing. It is best used only in disposable worktrees or sandboxed environments with limited credentials, and you should avoid the documented permission-bypass, yolo, and unattended background modes unless you have explicitly accepted the risk for that specific repository.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:40
• Finding: Delegated Claude Code Agents Run with Permission Checks Disabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:44-47, 59, 239`; `agents/openai.yaml:16`; `references/claude-code-commands.md:7-13, 21-27, 42` **Vulnerability Type**: Permission-control bypass in delegated agent execution **Risk Level**: High ### Vulnerable Code `SKILL.md:40-47`: ```bash ### Claude Code - 不需要 PTY ```bash # ✅ 正确用法（使用 --print 模式） exec command:"claude --permission-mode bypassPermissions --print '你的任务描述'" # 后台执行 exec background:true command:"claude --permission-mode bypassPermissions --print '你的任务描述'" ``` `agents/openai.yaml:13-16`: ```yaml 规则： - Codex/OpenCode/Pi 需要 pty:true - Claude Code 使用 --print --permission-mode bypassPermissions - 始终指定 workdir ``` `references/claude-code-commands.md:5-13`: ```bash # 一次性执行（推荐） claude --permission-mode bypassPermissions --print "你的提示词" # 后台执行 claude --permission-mode bypassPermissions --print "你的提示词" & # 指定工作目录 cd /path/to/project && claude --permission-mode bypassPermissions --print "你的提示词" ``` `references/claude-code-commands.md:19-22`: ```markdown | `--print` | 非交互模式，输出到标准输出 | | `--permission-mode bypassPermissions` | 跳过权限确认 | | `--dangerously-skip-permissions` | 跳过权限确认（旧版，可能提前退出） | ``` ### Technical Analysis The Skill consistently presents `--permission-mode bypassPermissions` as the recommended and default way to launch Claude Code. This option removes per-operation authorization prompts that would otherwise provide a security boundary between an AI-generated action and its execution. A coding agent commonly receives repository files as context and may execute shell commands, edit files, install dependencies, or access network resources. Repository content is potentially attacker-controlled, especially during pull-request review or work on an unfamiliar project. Malicious instructions embedded in source files, documentation, tests, issue content, or build configuration can therefore influence the delegated agent. The instruction to specify `workdir` reduces accidental cont ...[truncated 2016 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Remove permission bypass from the default workflow** - Launch Claude Code with its normal permission controls. - Do not describe `bypassPermissions` as recommended behavior. - Require explicit, task-specific user consent before enabling any bypass mode. 2. **Use an isolated execution environment** - Run delegated agents in a disposable container, VM, or restricted OS account. - Mount only the required repository into the environment. - Make unrelated host paths unavailable. - Avoid forwarding the host SSH agent or credential stores. 3. **Restrict process capabilities** - Apply filesystem allowlists covering only the intended workspace. - Disable outbound network access by default or permit only required destinations. - Remove unnecessary environment variables, API tokens, cloud credentials, and Git credentials. - Enforce CPU, memory, process, and execution-time limits. 4. **Require approval for high-risk operations** - Require user confirmation for shell execution, writes outside expected files, dependency installation, network access, Git pushes, and destructive commands. - Display the exact command and affected paths before execution. 5. **Harden untrusted-repository workflows** - Treat repository instructions and generated commands as untrusted input. - Review untrusted pull requests in temporary worktrees or disposable environments. - Do not execute build or test commands until their scripts and configuration have been reviewed. 6. **Harden package installation** - Use lockfile-enforced installation. - Disable lifecycle scripts where feasible when auditing unfamiliar repositories. - Review dependencies and installation scripts before enabling them. 7. **Update all duplicated guidance** - Correct `SKILL.md`, `agents/openai.yaml`, and `references/claude-code-commands.md` together so that the unsafe invocation is not reintroduced through secondary documentat ...[truncated 10 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- GET /todos - 获取所有待办
- POST /todos - 创建待办
- PUT /todos/:id - 更新待办
- DELETE /todos/:id - 删除待办

要求：
1. 使用 Express.js

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

exec workdir:/tmp/issue-78 command:"git push -u origin fix/issue-78 && gh pr create --title 'fix: ...' --body '...'"

# 5. 清理
exec command:"git worktree remove /tmp/issue-78"
```

## 📊 进度更新规则

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ssd 1

High

• Confidence: 98% confidence
• Finding: The instruction to run Claude Code with '--permission-mode bypassPermissions' explicitly disables an important safety control that would normally gate sensitive actions. In a general-purpose coding agent, this materially increases the risk of unauthorized file changes, command execution, or access to sensitive workspace contents if the agent is prompted unsafely or behaves unexpectedly.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# 一次性执行（推荐）
claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

• Confidence: 92% confidence
• Finding: This command invokes an external model provider and combines that delegation with permission-bypass flags. In a coding-agent context, sending prompts/code to an external tool can expand the trust boundary, and the bypassed permissions mean any resulting actions may occur without normal safety interlocks or user review.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

# 指定工作目录
cd /path/to/project && claude --permission-mode bypassPermissions --print "你的提示词"

• Confidence: 94% confidence
• Finding: This example runs the external coding tool in the background while also bypassing permission checks, reducing visibility and operator control over what the process does after launch. In an agent skill, background execution plus suppressed approvals makes unauthorized or unintended actions harder to detect and stop, especially if sensitive project files or credentials are accessible.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# 一次性执行
codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

# 无限制模式（危险）
codex exec --yolo "你的提示词"

• Confidence: 91% confidence
• Finding: `codex exec --full-auto` instructs users to delegate actions to an external coding agent with automatic approval, reducing human oversight over code changes, command execution, and potential data access. In a coding-agent skill, this materially increases the chance of harmful actions being executed without review.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex exec --full-auto "你的提示词"

# 无限制模式（危险）
codex exec --yolo "你的提示词"
```

## 代码审查

• Confidence: 96% confidence
• Finding: `codex exec --yolo` is explicitly an unrestricted mode and is especially dangerous in a coding-agent context because it can authorize broad autonomous actions with minimal safeguards. Even with a brief danger label, including it in a quick-reference guide can encourage risky use that leads to destructive edits, secret leakage, or unintended system changes.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex review --base main

# 审查特定提交
codex exec "审查 commit abc123 的变更"
```

## 配置

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

## 配置

配置文件位置：`~/.codex/config.toml`

```toml
[model]

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly recommends `claude --permission-mode bypassPermissions --print` and `codex exec --full-auto` without pairing those examples with immediate, prominent warnings about filesystem changes, secret access, network actions, or unintended destructive edits. In a coding-agent skill, these flags materially reduce safeguards and make it easier for an agent to perform impactful actions automatically if given a bad prompt or run in the wrong directory.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a general coding-agent wrapper for tools like Codex, Claude Code, and OpenCode, but this section instructs use of unrelated shell operations such as git worktree management, dependency installation, git push, and GitHub PR creation. Those are broader system/repository automation capabilities rather than direct delegation to coding agents, and they are not explicitly justified by the stated skill scope.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The manifest’s user-facing description and prompt content are entirely in Chinese, which imposes a specific language on users without indicating that language selection is optional. This can violate language or locale policy when the skill is not clearly documented as region-specific or offering user choice.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: This manifest describes the skill in very broad terms such as delegating 'coding tasks' and lists common activities like building features, refactoring, bug fixing, and code review. Because it does not define specific trigger phrases, scope limits, or exclusion conditions, the skill could be invoked for a wide range of everyday coding requests unintentionally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly recommends running Claude Code with permission checks bypassed and presents it as the preferred mode, without any warning, scope limitation, or trust boundary guidance. In an agent skill intended for coding tasks, this materially increases the chance that generated or delegated commands can perform filesystem, process, or network actions without user confirmation, making accidental or prompt-influenced misuse more dangerous.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly recommends `--full-auto` and `--yolo` to bypass interaction, and although `--yolo` is labeled dangerous, it still normalizes high-risk unattended execution in a coding-agent context. In a skill meant to guide automation and code modification, this can lead users to run destructive or exfiltrating actions without review.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language instructions throughout the skill are presented entirely in Chinese, but the file does not state that the skill is intended only for Chinese-speaking users or provide any opt-in language selection. Under the policy, forcing a specific language without user choice is a locale/language policy violation.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: The file states 'Codex / OpenCode / Pi - 需要 PTY' and separately that 'Claude Code - 不需要 PTY', while the manifest and requires list present Pi as a supported backend but provide no corresponding usage examples or consistent operational guidance elsewhere. This creates intent ambiguity in the documentation about supported wrapped tools and how they are actually meant to be used.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All user-facing instructional text in this file is written in Chinese, and there is no indication that the skill is region-specific or that users can choose another language. Under the stated policy, a fixed language without user opt-in or justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The natural-language content throughout the file forces a specific language presentation, which can be a locale-policy concern when no user opt-in or justification is provided. There is no indication that this skill reference is intentionally region-specific or that alternative language support exists.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The template instructs the agent to run a host command (`openclaw system event --text ... --mode now`) after completing a task, which is an actual side-effecting shell/system action. Even though it appears intended as a convenience notification, embedding executable commands in a reusable prompt template can normalize automatic command execution without explicit per-use consent, and may trigger environment-specific effects or fail unpredictably.

Static analysis

No suspicious patterns detected.