Security audit

Parallel Coding

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent worktree-based parallel coding guide, but it recommends running coding agents with permission bypass and broad shell environment loading without adequate warnings.

Install only if you are comfortable with coding agents making broad repository changes. Prefer normal permission prompts over `bypassPermissions`, avoid sourcing your full shell profile, use feature branches and least-privilege Git credentials, and manually review diffs, tests, pushes, and PRs before merge.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill explicitly recommends running Claude Code with `--permission-mode bypassPermissions`, which disables normal approval gates and grants the agent broader file/system capabilities than are necessary for parallelizing work with git worktrees. In this context, parallel development does not inherently require elevated permissions, so normalizing bypass mode materially increases the chance of unintended code execution, file modification, or secret exposure across multiple worktrees.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Advising users to `source ~/.zshrc` loads arbitrary shell initialization content and environment variables into the agent session, potentially exposing API keys, tokens, SSH settings, and other local secrets unrelated to the task. For a coding-parallelization skill, indiscriminately importing the full shell profile exceeds the minimum access needed and broadens the blast radius if the agent behaves unexpectedly.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The example uses `bypassPermissions` without warning that approval prompts are disabled, which can mislead users into granting unsafe authority by copy-pasting the command. Because this skill is operational guidance, omission of the warning makes risky behavior appear routine and can lead to silent file, network, or system actions by the agent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow tells agents to push code and create PRs/MRs but does not warn that this may transmit repository contents, metadata, and potentially sensitive code to remote hosting services. In a skill designed to orchestrate multiple coding agents, this omission is meaningful because automation increases the chance that users will delegate remote publication without considering data sensitivity.

Ssd 1

Medium

Confidence: 97% confidence
Finding: The examples semantically encourage elevated agent authority by presenting permission bypass as part of the normal parallel-execution workflow. Since the skill’s purpose is task parallelism, not privileged system administration, this guidance trains users toward unsafe defaults and magnifies the risk of broad unauthorized actions across several simultaneous agent sessions.

Ssd 1

Medium

Confidence: 97% confidence
Finding: The Claude Code section labels a non-interactive invocation with permission bypass as the recommended mode, effectively endorsing unsupervised elevated access. In parallel-task scenarios this is especially dangerous because multiple agents can concurrently make file, shell, or network changes without checkpoints, compounding the probability and impact of mistakes or abuse.

Static analysis

No suspicious patterns detected.