OpenClaw Coding Agent Workflows

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

This skill is a coding-agent orchestrator, but it recommends permission-bypassing and fully automated agent modes without enough containment or warning.

Install only if you are comfortable with delegated coding agents running with broad autonomy. Use conservative permission modes, disposable containers or VMs for untrusted repositories, remove inherited secrets, and inspect commands and changes before accepting results.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:22

Finding

Delegated Coding Agents Run with Permission Checks Disabled

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–35
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code

markdown

## Execution mode matrix
- `Codex`: use `pty:true`.
- `Pi`: use `pty:true`.
- `OpenCode`: use `pty:true`.
- `Claude Code`: use `--print --permission-mode bypassPermissions` (no PTY required).

Examples:

```bash
# Codex (PTY required)
bash pty:true workdir:~/project command:"codex exec --full-auto 'Add request timeout handling to API client and update tests.'"

# Claude Code (print mode, no PTY required)
bash workdir:~/project command:"claude --permission-mode bypassPermissions --print 'Refactor auth middleware and explain risk areas.'"

text

The unsafe Codex automation mode is also repeated in the background-session example at line 48:

```bash
bash pty:true workdir:~/project background:true command:"codex exec --full-auto 'Implement issue #142 and run tests.'"

Technical Analysis

The skill explicitly instructs users to launch Claude Code with --permission-mode bypassPermissions and Codex with --full-auto. These modes remove or substantially reduce interactive authorization boundaries around commands and other actions selected by the delegated agent.

A repository working directory, temporary clone, or Git worktree only isolates source-control state. It does not constitute an operating-system security boundary. Unless the agent is separately sandboxed, it can potentially execute commands with the invoking user's privileges, read files outside the repository, access inherited credentials and environment variables, modify user-owned resources, and initiate network connections.

Repository files and task context can contain attacker-controlled instructions. Consequently, using these modes during review or implementation can allow malicious repository content, build scripts, tests, or indirect prompt injection to influence an agent that is authorized to ...[truncated 1630 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --permission-mode bypassPermissions from the recommended Claude Code invocation and use a mode that requires approval for command execution, filesystem access outside the repository, network access, and other sensitive operations.
2. Do not recommend --full-auto as the default Codex mode. Use conservative execution settings and require explicit authorization for consequential actions.
3. Run delegated agents in a disposable container or virtual machine rather than relying on a clone or worktree as isolation.
4. Mount only the target repository into the sandbox and make unrelated host paths unavailable. Prefer a non-root user and a read-only mount when performing reviews.
5. Remove inherited credentials, secrets, SSH agents, cloud configuration, and unnecessary environment variables before launching the delegated agent.
6. Deny outbound network access by default. Where network access is required, restrict it to an explicit allowlist.
7. Separate review and implementation profiles: reviews should be read-only, while write access for implementation should be limited to the target repository.
8. Add a warning that repository content, tests, build scripts, and issue text are untrusted input and must not be treated as authoritative instructions.
9. Require users to inspect proposed commands and changes before execution or persistence, particularly when operating on third-party pull requests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of Claude Code with --permission-mode bypassPermissions, which disables normal permission gating and allows the delegated agent to act with elevated autonomy in the repository. In a skill whose purpose is to orchestrate automated code changes and reviews, this materially increases the chance of unintended file modifications, execution of risky commands, or broader repo impact without a clear user warning or compensating controls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.