Security audit

Code Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful but coherent code-agent orchestration plugin that discloses its background coding sessions, worktree handling, plan approval, PR, and advanced automation modes.

Install this only if you want OpenClaw to run local coding agents with access to your chosen repositories and local agent credentials. Keep review-oriented defaults or use ask/manual modes if you want explicit human control; avoid bypassPermissions, planApproval approve, auto-merge/auto-pr, and autonomous goal loops unless you trust the repo, the agent, and the route receiving callbacks. Be aware it persists session state/output, can use git and gh, checks for updates, and may clean old OpenClaw worktrees.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill description defines activation using broad natural-language phrases like "let oca do..." and similar wording, which can overlap with ordinary user conversation. That increases the chance of accidental invocation of a powerful orchestration skill that can launch coding agents and perform follow-up actions, potentially causing unintended autonomous operations.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The launch guidance again instructs the system to treat common conversational phrases such as "let oca do..." and "ask oca to..." as activation cues. In the context of a tool that can resume sessions, approve plans, and manage worktrees, ambiguous triggers expand the attack surface for prompt injection, accidental activation, or user confusion about when the orchestration layer is being engaged.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ### `planApproval: "approve"` - Auto-approve only after verification per the session policy. ## Worktree Decisions
Confidence: 85% confidence
Finding: The skill explicitly supports an auto-approve mode for plan approval, which delegates execution authorization to the orchestrator rather than requiring an end-user decision. Even though it says approval should occur only after verification, this still enables autonomous approval of agent plans, and if verification is weak, bypassed, or manipulated by adversarial context, the coding agent may proceed with risky or unintended changes without meaningful human review.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:224
Evidence: `)?t:void 0}import{unlinkSync as mf}from"fs";var br=class n{timers=new Map;disposed=!1;static MAX_DELAY_MS=2147483647;schedule(e,t,r){if(this.disposed||(this.ca...