Speckit Coding Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:02 PM UTC
• Version: 1.1.2

Overview

The skill is mostly SpecKit workflow documentation, but it normalizes unsandboxed no-approval coding agents and parallel background runs that users should review carefully before installing.

Install only if you are comfortable managing powerful coding agents yourself. Prefer sandboxed, approval-gated runs; avoid --yolo except in disposable environments; review all diffs; pin or verify third-party tools before installing; and do not run background or parallel agents in directories that contain credentials or live systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:3

Finding

Unpinned and Unverified Third-Party Tool Installation

Content

View full analysis

Remediation

View remediation

``` 2. Pin npm dependencies to an exact reviewed version rather than using the latest available release: ```bash npm install -g @mariozechner/pi-coding-agent@ ``` 3. Prefer isolated, project-local installations over global installations where supported. 4. Use official release channels and provide SHA-256 checksums or cryptographic signatures for downloaded installers. 5. Document how users must verify the installer signature or checksum before execution. 6. Generate and retain lockfiles for reproducible dependency resolution. 7. Add automated dependency scanning and provenance verification to the release process. 8. Review transitive dependencies and package lifecycle scripts before approving upgrades. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:347

Finding

Unrestricted Autonomous Agent Execution Without Sandbox or Approval

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Referencing ~/.codex/config.toml directs attention to a user-specific agent configuration path, which may contain provider settings, tokens, model preferences, or other sensitive local state. In a skill that encourages autonomous agent execution, normalizing access to home-directory config locations increases the risk of inadvertent reading or disclosure of sensitive configuration data.

Content

Scanner excerpt · README.md (reported line 345)May include surrounding context.

Codex CLI

Model: gpt-5.2-codex is the default (set in ~/.codex/config.toml)

Building/Creating (use --full-auto or --yolo)

bash

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 442)May include surrounding context.

6. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 579)May include surrounding context.

6. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 443)May include surrounding context.

6. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

**Why worktrees?** Each Codex works in isolated branch, no conflicts. Can run 5+ parallel fixes!

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 580)May include surrounding context.

6. Cleanup

tmux -S "$SOCKET" kill-server git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

**Why worktrees?** Each Codex works in isolated branch, no conflicts. Can run 5+ parallel fixes!

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Referencing ~/.codex/config.toml directs attention to an agent configuration directory in the user’s home folder, which may contain sensitive settings, tokens, or provider details. In a skill that already promotes powerful agent execution, normalizing access to home-directory config increases the risk of credential exposure or unintended reads outside the project scope.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

Codex CLI

Model: gpt-5.2-codex is the default (set in ~/.codex/config.toml)

Building/Creating (use --full-auto or --yolo)

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 317)May include surrounding context.

The Pattern: workdir + background

bash

# Create temp space for chats/scratch work
SCRATCH=$(mktemp -d)

# Start agent in target directory ("little box" - only sees relevant files)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

The Pattern: workdir + background

bash

# Create temp space for chats/scratch work
SCRATCH=$(mktemp -d)

# Start agent in target directory ("little box" - only sees relevant files)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation claims the agent is confined to a focused directory and 'doesn't wander off reading unrelated files,' but nearby guidance includes broad repo operations and later unsandboxed execution examples. This mismatch can create false trust in containment and lead users to approve runs under incorrect assumptions about what the agent can access or modify.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README’s stated purpose is Spec-Kit workflow integration, but it also instructs operators to launch powerful coding agents, background shell jobs, git operations, tmux sessions, and unsandboxed codex --yolo runs. That broadens the skill from documentation into operational delegation of high-privilege automation, increasing the chance that a user or agent executes destructive actions unrelated to Spec-Kit.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

--full-auto auto-approves workspace changes, reducing human oversight over agent-generated edits. While less dangerous than fully unsandboxed execution, it still increases the chance of incorrect, excessive, or policy-violating modifications being applied without review.

Content

Scanner excerpt · README.md (reported line 349)May include surrounding context.

Building/Creating (use --full-auto or --yolo)

bash

# --full-auto: sandboxed but auto-approves in workspace
bash workdir:~/project background:true command:"codex exec --full-auto \"Build a snake game with dark theme\""

# --yolo: NO sandbox, NO approvals (fastest, most dangerous)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

Documenting a mode with 'NO sandbox, NO approvals' explicitly endorses autonomous execution without human checkpoints. In the context of coding agents and shell command execution, that creates a direct pathway to unintended file modification, destructive commands, or execution of unsafe generated actions.

Content

Scanner excerpt · README.md (reported line 352)May include surrounding context.

--full-auto: sandboxed but auto-approves in workspace

bash workdir:~/project background:true command:"codex exec --full-auto "Build a snake game with dark theme""

--yolo: NO sandbox, NO approvals (fastest, most dangerous)

bash workdir:~/project background:true command:"codex --yolo "Build a snake game with dark theme""

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The codex --yolo example enables operation without sandboxing or approvals, but the dangerous consequences are not warned at the exact point of use with concrete data-loss or system-integrity risks. In practice, users may copy-paste the command and grant an autonomous agent unrestricted authority over project files or adjacent resources.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The rules section affirmatively recommends --full-auto for building, reinforcing approval bypass as normal practice. Repetition in the policy section increases the likelihood that operators will treat reduced oversight as standard, even in projects where autonomous changes are unsafe.

Content

Scanner excerpt · README.md (reported line 455)May include surrounding context.

md

1. **Respect tool choice** — if user asks for Codex, use Codex. NEVER offer to build it yourself!
2. **Be patient** — don't kill sessions because they're "slow"
3. **Monitor with process:log** — check progress without interfering
4. **--full-auto for building** — auto-approves changes
5. **Parallel is OK** — run many Codex processes at once for batch work
6. **NEVER start Codex in ~/clawd/** — it'll read your soul docs! Use the target project dir or /tmp for blank slate chats
7. **NEVER checkout branches in ~/Projects/clawdbot/** — that's the LIVE instance! Clone to /tmp or use git worktree for PR reviews

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s stated purpose is a SpecKit workflow, but this section expands into a general-purpose orchestration guide for external agents, background processes, tmux, cloning repos, and parallel worktrees. That capability creep materially increases the attack surface by encouraging execution of powerful tooling and long-lived sessions unrelated to the minimum needed function of the skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

--full-auto auto-approves workspace changes, allowing an agent to make modifications without interactive confirmation. While less severe than --yolo because it remains sandboxed, it still weakens human oversight and can produce unintended edits or broad repository changes if prompts or context are manipulated.

Content

Scanner excerpt · SKILL.md (reported line 488)May include surrounding context.

Building/Creating (use --full-auto or --yolo)

bash

# --full-auto: sandboxed but auto-approves in workspace
bash workdir:~/project background:true command:"codex exec --full-auto \"Build a snake game with dark theme\""

# --yolo: NO sandbox, NO approvals (fastest, most dangerous)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The 'NO sandbox, NO approvals' guidance explicitly endorses autonomous operation without safety checkpoints. In the context of coding agents that can run commands and modify files, removing both containment and approval barriers substantially raises the chance of destructive actions, data exposure, or execution of unsafe instructions.

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

--full-auto: sandboxed but auto-approves in workspace

bash workdir:~/project background:true command:"codex exec --full-auto "Build a snake game with dark theme""

--yolo: NO sandbox, NO approvals (fastest, most dangerous)

bash workdir:~/project background:true command:"codex --yolo "Build a snake game with dark theme""

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends Codex --yolo, which disables sandboxing and approvals, enabling unrestricted autonomous changes and command execution. Even though it says 'most dangerous,' it still presents the mode as a normal build option, which can normalize unsafe execution and lead to destructive or sensitive operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The guideline endorsing --full-auto for building normalizes autonomous approvals as a best practice. In a skill already containing broad execution and orchestration instructions, this increases operational risk by encouraging unattended modifications beyond the narrow SpecKit workflow.

Content

Scanner excerpt · SKILL.md (reported line 592)May include surrounding context.

md

1. **Respect tool choice** — if user asks for Codex, use Codex. Do not offer to build it yourself.
2. **Be patient** — don't kill sessions because they're "slow"
3. **Monitor with process:log** — check progress without interfering
4. **--full-auto for building** — auto-approves changes
5. **Parallel is OK** — run many Codex processes at once for batch work
6. **Avoid starting Codex in ~/clawd/** — it may read sensitive docs. Use target project dir or /tmp for blank slate chats
7. **Avoid checking out branches in ~/Projects/clawdbot/** — that directory contains the LIVE instance. Clone to /tmp or use git worktree for PR reviews

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes /speckit.implement as automatically updating TASKS.md but does not clearly warn that invoking it modifies project files. This can cause users to run the command assuming it is read-only, creating unexpected repository changes or masking unintended edits in generated tracking data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file is predominantly in English, but one fallback label is written in Portuguese (Secundário), creating an inconsistent language experience without any user opt-in or documented locale rationale. That can violate language/locale policy expectations for consistent user-facing instructions.

Content

No source excerpt is available for this finding.