Codeflicker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:26 AM UTC
• Version: 1.1.1

Overview

This skill is a disclosed wrapper for Kuaishou's CodeFlicker coding CLI, but it broadly delegates development work to a tool that can be put into persistent global auto-execute mode.

Review before installing. Use this only if you intend to delegate coding work to CodeFlicker under your Kuaishou account. Keep approvalMode at default unless you are in a disposable, isolated workspace, avoid global yolo mode for normal work, pin or otherwise verify the CLI package where possible, and treat workspace delete, workspace complete, MCP additions, and natural-language shell execution as high-impact actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Remediation

View remediation

``` 2. Publish and verify the expected package integrity digest or registry signature before installation. 3. Document a trusted publisher identity and a process for validating new releases. 4. Prefer a project-local installation with a committed lockfile over global installation where operationally possible. 5. Review package lifecycle scripts before approving a release. Use `--ignore-scripts` if lifecycle scripts are not required. 6. Deploy packages through an internal allowlisted mirror that retains reviewed, immutable artifacts. 7. Avoid recommending elevated installation and explicitly state that users must not use `sudo` unless it is demonstrably required. 8. Add an update policy requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:80

Finding

Global Unattended Execution Mode Recommended for an AI Coding Tool

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

Specify model:

bash

flickcli -m glm-5 "task"

Specify working directory:

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

# Add MCP server
flickcli mcp add my-server npx @example/mcp-server

# List MCP servers
flickcli mcp list

# Remove MCP server

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

Documenting and encouraging autonomous decision-making via auto-execute in a coding assistant materially raises operational risk. Because this skill is designed to run development tasks and shell-related workflows, autonomous execution can amplify harmful outputs from model mistakes or adversarial prompts into real system changes without human review.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md

# Set default model
codeflicker/scripts/config.sh model glm-5

# Set auto-execute mode
codeflicker/scripts/config.sh approvalMode yolo

# View all config

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation recommends or normalizes approvalMode yolo as a configuration option for auto-execution without any safety warning. In an AI coding assistant context, removing approval gates can cause the agent to execute shell commands or modify code automatically, increasing the risk of unintended destructive actions, unsafe command execution, or prompt-influenced behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to run flickcli workspace delete <name> and labels it 'Delete without merge', but it does not include any warning about potential data loss or irreversible removal of an isolated development workspace. For markdown files, actions that can affect user data or system integrity should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description is written as a Chinese-only product description and targets '快手员工专用' without indicating whether other languages are supported or whether this locale restriction is optional. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The auto-use trigger says to invoke the tool whenever development tasks are needed, which is very broad and can cause the agent to hand off many ordinary requests to an external CLI by default. In this context, the risk is increased because the CLI supports shell generation, writes, workspaces, and external services, so over-triggering can expand the attack surface and cause unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation promotes approvalMode yolo, which enables automatic execution, but only gives a brief 'use with caution' note rather than a clear warning about code execution, file modification, and system state changes. In an agent skill, that is dangerous because users or orchestrators may enable it without understanding that the tool can perform irreversible actions autonomously.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill explicitly advertises an approval mode where the tool will 'auto execute'. In this skill's context, that is risky because the same CLI can modify code, generate and run shell commands, and operate in workspaces, so autonomous execution can lead to unintended or unsafe actions without a human checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

Approval modes:
- `default` - require confirmation
- `autoEdit` - auto edit
- `yolo` - auto execute (use with caution)

## Usage

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill documents adding an MCP server via npx @example/mcp-server without pinning a specific package version. This creates a supply-chain risk because future package updates or a compromised upstream release could change behavior and execute unexpected code when the server is installed or run.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The quick reference includes approvalMode yolo as a concise command for auto-execute mode, making an unsafe capability easy to enable. Presenting it in a shortcut table increases the chance of casual adoption without reading detailed warnings, which is problematic for a coding agent that can change files and run commands.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

| `flickcli -q -c "task"` | Continue session |
| `flickcli -q -r <id> "task"` | Resume session |
| `flickcli -q --cwd /path "task"` | Run in specific directory |
| `flickcli config set -g approvalMode yolo` | Auto-execute mode |
| `flickcli workspace create` | Create git worktree |
| `flickcli workspace complete` | Merge workspace |
| `flickcli run` | Natural language to shell |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The notes section states that yolo mode auto-executes all operations, confirming the capability for unrestricted autonomous action. Given that this skill is meant to be auto-used for development tasks, that combination materially raises the risk of accidental command execution, code changes, or other system modifications.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md

- **Must login with SSO before first use:** `flickcli /login`
- **Recommended: Create ~/work directory** for project base
- Use `--cwd` to specify working directory for development tasks
- yolo mode auto-executes all operations
- Workspace feature uses git worktrees for isolated development

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description states the skill is "快手员工专用" and is written entirely in Chinese, which indicates a language/locale-specific constraint without offering any user choice or opt-in. The policy requires flagging language or locale restrictions unless they are explicitly justified or optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments and all user-visible output strings are written only in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended solely for a Chinese-speaking environment. This matches the policy category for language or locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script executes flickcli workspace delete "$NAME" directly after validating that a name was provided. While the usage text documents the delete command, there is no inline confirmation prompt, cautionary message, or explanatory comment near the destructive operation itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README includes a Chinese-only organizational usage statement (快手员工专用) without offering a language choice or bilingual explanation. This can constitute a language/locale policy issue because the skill documentation presents a fixed language context without explicit user opt-in or accommodation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comment and all user-facing messages are in Chinese, which imposes a specific language on users. There is no opt-in, fallback, or documentation indicating this skill is intended only for Chinese-speaking or region-specific use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

All comments and user-facing help/output strings in the script are written in Chinese, including usage guidance and success messages. This imposes a specific language on users without opt-in or an explicit locale selection mechanism, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script's comments and all visible user-facing output are written in Chinese, including usage help and error messages. There is no indication that the skill is intended only for Chinese-speaking users or any option to select another language, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.