Coding Agent (Claude Print + PTY Rules)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:44 AM UTC
• Version: 0.1.0

Overview

This skill is for delegating coding work to other agents, but it repeatedly recommends running them with reduced or disabled safety controls, including workflows that can install dependencies, change code, commit, push, and signal the host system.

Review this skill carefully before installing. It can be useful for delegating coding work, but only use it in isolated repositories or disposable worktrees, avoid --yolo and permission-bypass modes unless you explicitly accept the risk, and do not let spawned agents commit, push, install dependencies, or trigger host events without reviewing the exact command and resulting changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:23

Finding

Delegated Coding Agents Are Run Without Permission or Sandbox Controls

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The skill repeatedly recommends running delegated coding agents with `--permission-mode bypassPermissions` or `--yolo`. These options remove interactive authorization boundaries and, in the latter case, explicitly disable both sandboxing and approvals. Coding agents consume prompts, repository files, issue descriptions, dependency metadata, a ...[truncated 2426 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:190

Finding

Unpinned Package Installation and Lifecycle Script Execution

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The skill recommends globally installing a third-party npm package without pinning a reviewed version or documenting integrity and provenance verification. An unpinned global installation resolves whatever package version the registry serves at execution time, meaning the effective installed code may change after this skill has been audited. The worktree examples also invoke `pnpm install` directly against project-controlled dependency metadata. Package managers can execute dependency lifecycle scripts during installation. If the package registry, a transitive dependency, the lockfile, or the project manifest has been compromised, installation may execute attacker-controlled code with the privileges of the invoking user. Combining dependency installation with `codex --yolo` compounds the exposure: package installation can execute lifecycle code, after which an agent is launched without sandbox or approval controls in the same command chain. ### Attack Path 1. An attacker compromises the referenced package, one of its transitive dependencies, a registry account, or dependency metadata in the target repository. 2. The user follows the skill and runs the unpinned global `npm install` or project-level `pnpm install`. 3. The package manager retrieves the attacker-control ...[truncated 1220 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs use of claude --permission-mode bypassPermissions, which disables an important confirmation and permission barrier while presenting it as the preferred operating mode. In a coding-agent skill that delegates arbitrary repository tasks, this materially increases the chance of unreviewed file modifications, command execution, or access to sensitive project content.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

## Codex CLI

**Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml)

### Flags

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill recommends codex --yolo, explicitly described as having no sandbox and no approvals, and includes examples for real project refactors. That meaningfully lowers safety controls for an autonomous coding agent and can permit unrestricted local changes, destructive commands, or sensitive data exposure without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill provides an automation flow that installs dependencies, makes code changes, commits, pushes branches, and prepares PR creation, but does not present a consolidated warning that these steps modify repositories and publish changes remotely. In combination with autonomous agents, this can cause unintended code execution from dependencies and unauthorized remote updates.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Quick Start: One-Shot Tasks

For quick prompts/chats, create a temp git repo and run:

bash

# Quick chat (Codex needs a git repo!)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

--full-auto is described as auto-approving changes in the workspace, which is a real reduction in human oversight. While less dangerous than --yolo because it remains sandboxed, it still permits autonomous modifications that may be undesirable in sensitive repositories.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

| Flag            | Effect                                             |
| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The --yolo flag is documented as disabling sandboxing and approvals, enabling autonomous decision-making without user checkpoints. In a delegation skill, normalizing this mode increases the likelihood that the spawned agent performs risky or irreversible actions without review.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This example operationalizes --full-auto for building features in a real project, directly encouraging autonomous code changes. Even with sandboxing, automatic approval can lead to unnoticed edits, broken builds, or policy-violating modifications when used broadly.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Building/Creating

bash

# Quick one-shot (auto-approves) - remember PTY!
bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'"

# Background for longer work

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

For fixing multiple issues in parallel, use git worktrees:

bash

# 1. Create worktrees for each issue
git worktree add -b fix/issue-78 /tmp/issue-78 main
git worktree add -b fix/issue-99 /tmp/issue-99 main

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The rule --full-auto for building codifies reduced-oversight execution as standard practice. In a skill whose purpose is to spawn coding agents, treating auto-approval as routine increases the chance of unintended or insufficiently reviewed modifications.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

- If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over.
3. **Be patient** - don't kill sessions because they're "slow"
4. **Monitor with process:log** - check progress without interfering
5. **--full-auto for building** - auto-approves changes
6. **vanilla for reviewing** - no special flags needed
7. **Parallel is OK** - run many Codex processes at once for batch work
8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs delegated agents to invoke openclaw system event, which is a host-level side effect outside the core coding task. That gives spawned agents a pathway to trigger system notifications or wake events on the host, expanding their authority beyond editing code and increasing the risk of abuse, spam, or unintended orchestration actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.