T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:40- Finding
Delegated Claude Code Agents Run with Permission Checks Disabled by Default
- Content
View full analysis
- Remediation
View remediation
Security audit
coding-agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coding-agent launcher, but it recommends unattended and permission-bypassing modes that can run commands or change files without enough user review.
Review this skill carefully before installing. It is best used only in disposable worktrees or sandboxed environments with limited credentials, and you should avoid the documented permission-bypass, yolo, and unattended background modes unless you have explicitly accepted the risk for that specific repository.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - GET /todos - 获取所有待办 - POST /todos - 创建待办 - PUT /todos/:id - 更新待办 - DELETE /todos/:id - 删除待办 要求： 1. 使用 Express.js
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
exec workdir:/tmp/issue-78 command:"git push -u origin fix/issue-78 && gh pr create --title 'fix: ...' --body '...'"
5. 清理
exec command:"git worktree remove /tmp/issue-78"
text ## 📊 进度更新规则
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to run Claude Code with '--permission-mode bypassPermissions' explicitly disables an important safety control that would normally gate sensitive actions. In a general-purpose coding agent, this materially increases the risk of unauthorized file changes, command execution, or access to sensitive workspace contents if the agent is prompted unsafely or behaves unexpectedly.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
This command invokes an external model provider and combines that delegation with permission-bypass flags. In a coding-agent context, sending prompts/code to an external tool can expand the trust boundary, and the bypassed permissions mean any resulting actions may occur without normal safety interlocks or user review.
- Content
bash # 一次性执行（推荐） claude --permission-mode bypassPermissions --print "你的提示词" # 后台执行 claude --permission-mode bypassPermissions --print "你的提示词" &
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
This example runs the external coding tool in the background while also bypassing permission checks, reducing visibility and operator control over what the process does after launch. In an agent skill, background execution plus suppressed approvals makes unauthorized or unintended actions harder to detect and stop, especially if sensitive project files or credentials are accessible.
- Content
md claude --permission-mode bypassPermissions --print "你的提示词" # 后台执行 claude --permission-mode bypassPermissions --print "你的提示词" & # 指定工作目录 cd /path/to/project && claude --permission-mode bypassPermissions --print "你的提示词"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash # 一次性执行 codex exec "你的提示词" # 自动批准模式 codex exec --full-auto "你的提示词"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
codex exec --full-autoinstructs users to delegate actions to an external coding agent with automatic approval, reducing human oversight over code changes, command execution, and potential data access. In a coding-agent skill, this materially increases the chance of harmful actions being executed without review.- Content
md codex exec "你的提示词" # 自动批准模式 codex exec --full-auto "你的提示词" # 无限制模式（危险） codex exec --yolo "你的提示词"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
codex exec --yolois explicitly an unrestricted mode and is especially dangerous in a coding-agent context because it can authorize broad autonomous actions with minimal safeguards. Even with a brief danger label, including it in a quick-reference guide can encourage risky use that leads to destructive edits, secret leakage, or unintended system changes.- Content
codex exec --full-auto "你的提示词"
无限制模式（危险）
codex exec --yolo "你的提示词"
text ## 代码审查
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
codex review --base main
审查特定提交
codex exec "审查 commit abc123 的变更"
text ## 配置
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
配置
配置文件位置：
~/.codex/config.tomltoml [model]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly recommends
claude --permission-mode bypassPermissions --printandcodex exec --full-autowithout pairing those examples with immediate, prominent warnings about filesystem changes, secret access, network actions, or unintended destructive edits. In a coding-agent skill, these flags materially reduce safeguards and make it easier for an agent to perform impactful actions automatically if given a bad prompt or run in the wrong directory.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a general coding-agent wrapper for tools like Codex, Claude Code, and OpenCode, but this section instructs use of unrelated shell operations such as git worktree management, dependency installation, git push, and GitHub PR creation. Those are broader system/repository automation capabilities rather than direct delegation to coding agents, and they are not explicitly justified by the stated skill scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest’s user-facing description and prompt content are entirely in Chinese, which imposes a specific language on users without indicating that language selection is optional. This can violate language or locale policy when the skill is not clearly documented as region-specific or offering user choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest describes the skill in very broad terms such as delegating 'coding tasks' and lists common activities like building features, refactoring, bug fixing, and code review. Because it does not define specific trigger phrases, scope limits, or exclusion conditions, the skill could be invoked for a wide range of everyday coding requests unintentionally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly recommends running Claude Code with permission checks bypassed and presents it as the preferred mode, without any warning, scope limitation, or trust boundary guidance. In an agent skill intended for coding tasks, this materially increases the chance that generated or delegated commands can perform filesystem, process, or network actions without user confirmation, making accidental or prompt-influenced misuse more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document explicitly recommends
--full-autoand--yoloto bypass interaction, and although--yolois labeled dangerous, it still normalizes high-risk unattended execution in a coding-agent context. In a skill meant to guide automation and code modification, this can lead users to run destructive or exfiltrating actions without review.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions throughout the skill are presented entirely in Chinese, but the file does not state that the skill is intended only for Chinese-speaking users or provide any opt-in language selection. Under the policy, forcing a specific language without user choice is a locale/language policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The file states 'Codex / OpenCode / Pi - 需要 PTY' and separately that 'Claude Code - 不需要 PTY', while the manifest and requires list present Pi as a supported backend but provide no corresponding usage examples or consistent operational guidance elsewhere. This creates intent ambiguity in the documentation about supported wrapped tools and how they are actually meant to be used.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing instructional text in this file is written in Chinese, and there is no indication that the skill is region-specific or that users can choose another language. Under the stated policy, a fixed language without user opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language content throughout the file forces a specific language presentation, which can be a locale-policy concern when no user opt-in or justification is provided. There is no indication that this skill reference is intentionally region-specific or that alternative language support exists.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The template instructs the agent to run a host command (
openclaw system event --text ... --mode now) after completing a task, which is an actual side-effecting shell/system action. Even though it appears intended as a convenience notification, embedding executable commands in a reusable prompt template can normalize automatic command execution without explicit per-use consent, and may trigger environment-specific effects or fail unpredictably.- Content