Security audit

Coding Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent coding-agent orchestration guide, but it encourages no-approval agents, background execution, remote publishing, and host notifications without enough user checkpoints.

Install only if you deliberately want a skill that launches and supervises other coding agents. Prefer temporary clones or worktrees, avoid --yolo unless the workspace is disposable, inspect diffs before commits, and require explicit approval before GitHub comments, pushes, PR creation, package installs, or host notification commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs spawned agents to run an out-of-band host notification command (`openclaw system event`) on completion. That creates an external signaling path not strictly necessary for coding delegation, and it can be repurposed to exfiltrate status or content-derived summaries from the working context without explicit user approval.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The skill says PR reviews should be done in a temp directory, but later examples run review-style tasks directly in `~/project`. This inconsistency can cause users to operate against a live working tree, increasing risk of accidental modification, credential exposure, or contamination of unrelated repositories during review workflows.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The invocation criteria are very broad, covering many common coding activities such as building features, refactoring, and PR review. Without tighter activation boundaries, the skill may be over-invoked for tasks better handled with safer local tools, leading to unnecessary spawning of autonomous agents with broad filesystem context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill normalizes use of `--full-auto` and especially `--yolo`, which removes sandboxing and approvals, but does not consistently require prominent user-facing consent at each use site. This can enable autonomous code changes and command execution with insufficient oversight, increasing the chance of destructive edits, secret access, or unsafe system actions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example instructs posting review results to GitHub without warning that generated review content may include sensitive repository details or internal analysis. This creates an outbound data transmission path to an external service without explicit acknowledgement of confidentiality or approval requirements.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The completion hook directs an agent to emit an external event command upon finishing, but does not warn that this transmits information outside the immediate task flow. Even the brief summary in the event text can leak project names, features, or operational status, and the mechanism creates a covert outbound channel.

Static analysis

No suspicious patterns detected.