Security audit

Agenter Coder

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed autonomous coding-agent skill, but users should treat it like a tool that can read, edit, and run commands in the chosen workspace.

Install only if you trust the Agenter package and the AI provider you choose. Run it in a git-controlled or disposable workspace, keep sandboxing enabled, set cost/time/token limits, restrict `--allowed-write-paths` when possible, and avoid `--no-sandbox` except inside an isolated container or VM.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README clearly states that the skill delegates coding to a separate autonomous agent, but it does not explicitly warn users that the agent may create, modify, or overwrite local files as part of completing tasks. In a coding-agent skill, that omission is security-relevant because users may invoke it without appreciating that execution can lead to filesystem changes beyond chat-only assistance.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill recommends invoking an autonomous coding agent for very broad categories like writing, modifying, refactoring, and fixing bugs, without requiring tighter preconditions such as scope limits, path restrictions, or user confirmation for destructive actions. In this context, broad routing increases the chance the skill is used for high-impact workspace modifications with insufficient human review, especially because the delegated agent can edit files and run commands in its own process.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly advertises that the sub-agent performs file reading, editing, and bash execution in its own process, but it frames this mainly as a context-saving benefit and does not prominently warn about possible workspace changes or command side effects. Because users may treat the skill as a routine coding helper, the lack of upfront risk disclosure can lead to unintended file modification, destructive commands, or broader-than-expected changes in the working directory.

Missing User Warnings

High

Confidence: 88% confidence
Finding: The documentation explicitly presents OpenHands as using full code execution and requiring '--no-sandbox' while also calling it suitable for users who want runtime capabilities, but it does not prominently warn that this materially increases host risk. In a skill that delegates coding tasks to autonomous agents, normalizing a no-sandbox backend can lead users to select an execution mode with far weaker containment than the other backends.

Static analysis

No suspicious patterns detected.