T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:60- Finding
Shell Command Injection Through Interpolated Task Text
- Content
View full analysis
- Remediation
View remediation
Security audit
Coding Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed guide for launching coding agents, but it repeatedly encourages high-impact unsandboxed or auto-approved runs, package installs, and remote GitHub changes without strong review gates.
Install only if you are comfortable with a skill that can guide your agent to launch other coding agents with broad local authority. Prefer sandboxed runs, isolated worktrees or containers, pinned dependencies, and manual review before commits, pushes, PR comments, or PR creation. Avoid using the `--yolo` examples on sensitive or untrusted repositories.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:92- Finding
Delegated Agents Are Encouraged to Run Without Sandbox or Approval Controls
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:151- Finding
Unpinned Package Installation and Unreviewed Lifecycle-Script Execution
- Content
View full analysis
. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The global npm installation does not pin an exact package version or verify integrity or provenance. A later package release, compromised maintainer account, registry compromise, or malicious transitive dependency could therefore change the code executed by users after the skill has been audited. The `pnpm install` workflow can also execute dependency lifecycle scripts from an untrusted project. These scripts run during installation, before the coding agent starts, and can perform arbitrary actions with the package manager process's permissions. Combining installation with `&& codex --yolo` does not isolate the install stage and leaves the subsequent delegated agent unrestricted. Although the audit found no evidence that the named package is itself malicious, the installation practice creates avoidable supply-chain exposure. ### Attack Path 1. An attacker compromises the referenced package, one of its transitive dependencies, a package maintainer account, or an untrusted project's dependency metadata. 2. A user follows the skill and runs the unpinned global installation or `pnpm install`. 3. The package manager resolves attacker-controlled content that ...[truncated 995 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Codex CLI **Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml) ### Flags
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This example tells an autonomous
--yolorun to 'Commit and push,' combining no-sandbox/no-approval execution with immediate remote publication. That is especially dangerous because it allows unreviewed code, secrets, destructive changes, or malicious modifications to be persisted locally and propagated to a remote repository without a human checkpoint.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Quick Start: One-Shot Tasks
For quick prompts/chats, create a temp git repo and run:
bash # Quick chat (Codex needs a git repo!)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
--full-autoauto-approves changes in the workspace, reducing human oversight over edits produced by the delegated agent. While less dangerous than--yolo, it still encourages unattended modification of project files, which can introduce insecure code or unintended changes if used broadly.- Content
md | Flag | Effect | | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Documenting a mode with 'NO sandbox, NO approvals' is an endorsement of autonomous execution without safety controls. In a skill designed to launch coding agents on local projects, this increases the risk that the child agent can make broad uncontrolled changes or perform unexpected actions in the working environment.
- Content
md | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
This concrete example operationalizes
--full-autofor building tasks, reinforcing unattended workspace modification as normal practice. In real projects, that can create insecure or unexpected code changes with no review checkpoint before the task completes.- Content
Building/Creating
bash # Quick one-shot (auto-approves) - remember PTY! bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'" # Background for longer work
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples promote
--yolo, which explicitly disables sandboxing and approvals, without a strong user-facing control gate tied to destructive consequences. Encouraging this mode normalizes unrestricted autonomous execution, increasing the chance of unintended file changes, credential exposure, or remote side effects when used in real repositories.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill materially expands scope from delegating local coding work to performing external side-effecting GitHub operations such as cloning, commenting on PRs, pushing branches, and creating PRs. That broadens the delegated agent's authority from code editing into remote repository modification, which can leak data, spam or tamper with PR discussions, and publish unreviewed changes to remotes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
For fixing multiple issues in parallel, use git worktrees:
bash # 1. Create worktrees for each issue git worktree add -b fix/issue-78 /tmp/issue-78 main git worktree add -b fix/issue-99 /tmp/issue-99 main
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The rules section explicitly recommends
--full-auto for building, normalizing autonomous approval as standard operating procedure. Recommending reduced oversight in a reusable skill increases the likelihood that operators invoke it in sensitive repositories without appreciating the review gap.- Content
md - If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over. 3. **Be patient** - don't kill sessions because they're "slow" 4. **Monitor with process:log** - check progress without interfering 5. **--full-auto for building** - auto-approves changes 6. **vanilla for reviewing** - no special flags needed 7. **Parallel is OK** - run many Codex processes at once for batch work 8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs embedding a host-level notification command inside the delegated agent's prompt, effectively granting the spawned coding agent authority to emit system events on the host. This creates an out-of-band signaling channel that can be abused for spoofed completion signals, prompt injection pivoting, or triggering unintended host workflows beyond the original coding task.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The heading text states 'Use bash (with optional background mode) for all coding agent work,' but this is softened rather than contradicted by later examples. However, the stronger manifest claim of delegation 'via background process' conflicts with repeated foreground examples like
codex exec,claude,opencode run, andpicommands that are not backgrounded.- Content
Static analysis
No suspicious patterns detected.