Giga Coding Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:08 PM UTC
• Version: 1.0.0

Overview

The skill is coherent as a background coding-agent helper, but it normalizes unsafe autonomous modes and remote publishing without enough user checkpoints.

Install only if you are comfortable supervising powerful coding agents. Avoid --yolo for normal work, prefer sandboxed/approval-gated modes, use narrow temporary worktrees, review diffs before any commit/push/PR/comment, do not publish prompt history or session logs unless intentional, and avoid unpinned global npm installs where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:44

Finding

Codex Sandbox and Approval Controls Explicitly Disabled

Content

View full analysis

. Commit and push.'" Enter tmux -S "$SOCKET" send-keys -t fix-99 "cd /tmp/issue-99 && pnpm install && codex --yolo 'Fix issue #99: . Commit and push.'" Enter ``` ### Technical Analysis The Skill explicitly recommends `--yolo`, documented in the file itself as an alias for `--dangerously-bypass-approvals-and-sandbox`. This removes two independent security boundaries: 1. The sandbox boundary that restricts access to files, processes, and other host resources. 2. The approval boundary that requires confirmation before sensitive operations. The parallel workflow compounds the risk by running `pnpm install`, allowing an unrestricted coding agent to modify a repository, and directing it to commit and push changes. Repository content, issue descriptions, package lifecycle scripts, or other untrusted instructions can therefore influence a process operating without normal isolation or approval controls. ### Attack Path 1. An attacker places malicious instructions in an issue description, source file, dependency metadata, or docume ...[truncated 1435 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:211

Finding

Mandatory Third-Party Branding Hijacks Published Pull Request Output

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:123

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Codex CLI

Model: gpt-5.2-codex is the default (set in ~/.codex/config.toml)

Building/Creating (use --full-auto or --yolo)

bash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

8. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

8. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

**Why worktrees?** Each Codex works in isolated branch, no conflicts. Can run 5+ parallel fixes!

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

The Pattern: workdir + background

bash

# Create temp space for chats/scratch work
SCRATCH=$(mktemp -d)

# Start agent in target directory ("little box" - only sees relevant files)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

--full-auto auto-approves changes in the workspace, enabling the agent to make code and file modifications without per-action human review. Even with sandboxing, this increases the risk of unintended edits, unsafe command execution, or silent propagation of bad changes when used as routine guidance.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Building/Creating (use --full-auto or --yolo)

bash

# --full-auto: sandboxed but auto-approves in workspace
bash workdir:~/project background:true command:"codex exec --full-auto \"Build a snake game with dark theme\""

# --yolo: NO sandbox, NO approvals (fastest, most dangerous)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The phrase 'NO sandbox, NO approvals' describes a fully autonomous operating mode for an external coding agent. In this skill's context, that means code execution and file modification can occur without meaningful containment or user checkpoints, materially increasing the chance of destructive or unauthorized actions.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

# --full-auto: sandboxed but auto-approves in workspace
bash workdir:~/project background:true command:"codex exec --full-auto \"Build a snake game with dark theme\""

# --yolo: NO sandbox, NO approvals (fastest, most dangerous)
bash workdir:~/project background:true command:"codex --yolo \"Build a snake game with dark theme\""

# Note: --yolo is a shortcut for --dangerously-bypass-approvals-and-sandbox

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly recommends codex --yolo, which disables both sandboxing and approval checks, allowing an autonomous coding agent to execute arbitrary actions in the target directory without human review. Although the text notes it is 'most dangerous,' it still presents the command as a normal option for building tasks and does not require strong safeguards, making accidental unsafe use likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This workflow instructs the agent to Commit and push and then create PRs against remote repositories, but does not add an explicit warning that these steps mutate external systems and may publish unintended code. In a background or semi-autonomous agent context, this can cause unauthorized changes, data leakage, or supply-chain impact beyond the local machine.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The rule '--full-auto for building' institutionalizes automatic approval of agent actions as a standard practice. In a skill designed for background execution, that reduces human oversight and makes misuse or accidental harmful changes more likely, especially when paired with broad project directories.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

1. **Respect tool choice** — if user asks for Codex, use Codex. NEVER offer to build it yourself!
2. **Be patient** — don't kill sessions because they're "slow"
3. **Monitor with process:log** — check progress without interfering
4. **--full-auto for building** — auto-approves changes
5. **vanilla for reviewing** — no special flags needed
6. **Parallel is OK** — run many Codex processes at once for batch work
7. **NEVER start Codex in ~/clawd/** — it'll read your soul docs and get weird ideas about the org chart! Use the target project dir or /tmp for blank slate chats

Static analysis

No suspicious patterns detected.