OpenClaw Coding Agent Playbook

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent coding-agent delegation helper, but it defaults to bypassed or highly automated permission modes for agents that can edit files and run commands.

Install only if you are comfortable supervising delegated coding agents with elevated autonomy. Prefer trusted repositories, disposable worktrees or containers, minimal environment variables, no exposed secrets, and safer permission modes unless you intentionally opt into full automation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:23

Finding

Delegated Agents Run with Bypassed or Automatic Permission Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–49
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code Snippet:

markdown

## Execution mode matrix
- `Codex`: use `pty:true`.
- `Pi`: use `pty:true`.
- `OpenCode`: use `pty:true`.
- `Claude Code`: use `--print --permission-mode bypassPermissions` (no PTY required).

Examples:

```bash
# Codex (PTY required)
bash pty:true workdir:~/project command:"codex exec --full-auto 'Add request timeout handling to API client and update tests.'"

# Claude Code (print mode, no PTY required)
bash workdir:~/project command:"claude --permission-mode bypassPermissions --print 'Refactor auth middleware and explain risk areas.'"

# OpenCode (PTY required)
bash pty:true workdir:~/project command:"opencode run 'Add retry/backoff for webhook delivery.'"

# Pi (PTY required)
bash pty:true workdir:~/project command:"pi 'Fix failing Vitest suite in src/api and keep behavior unchanged.'"

bash

# Start
bash pty:true workdir:~/project background:true command:"codex exec --full-auto 'Implement issue #142 and run tests.'"

Technical Analysis

The skill explicitly directs Claude Code to run with --permission-mode bypassPermissions and recommends Codex's --full-auto mode for implementation tasks. These options disable or substantially weaken interactive approval boundaries while the delegated agent can inspect repository content, modify files, and invoke development commands.

Repository files are not necessarily trusted input. Source code, documentation, issue content, test fixtures, and configuration files can contain adversarial instructions intended to manipulate a coding agent. Running an agent against such content without permission prompts increases the likelihood that repository-controlled instructions can induce operations beyond the user's intended objective.

The safe-review w ...[truncated 2207 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --permission-mode bypassPermissions from the default Claude Code command and use a mode that requires approval for shell commands, sensitive reads, and filesystem writes.
2. Do not recommend --full-auto as the default. Make it an explicit, informed opt-in limited to trusted repositories and tightly isolated environments.
3. Default review tasks to read-only operation and allow writes only when implementation is explicitly requested.
4. Run delegated agents in a sandbox or disposable container with the project directory as the only writable mount.
5. Block access to the user's home directory, SSH material, cloud credentials, package-manager credentials, and unrelated repositories.
6. Provide a minimal environment with secrets and unnecessary environment variables removed.
7. Disable network access by default, enabling only narrowly scoped destinations when the task requires it.
8. Require explicit user confirmation before commands that install dependencies, execute repository scripts, access paths outside the workspace, or make network requests.
9. Retain the temporary clone or worktree workflow, but clarify that checkout isolation must be combined with process, filesystem, credential, and network isolation.
10. Document attacker-controlled repository content as untrusted input and instruct delegated agents not to treat repository text as authoritative operational instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly recommends running Claude Code with --permission-mode bypassPermissions, which disables the agent's normal permission gating and allows unrestricted actions in the target repository context. In a skill whose purpose is delegated coding and review, this materially increases the chance of destructive file changes, secret exposure, execution of unsafe commands, or supply-chain-impacting edits if prompts, repo contents, or downstream agent behavior are adversarial or mistaken.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.