Qoder CLI skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 0.1.0

Overview

This skill is mainly a Qoder CLI usage guide, but it recommends bypassing permission checks, running unpinned external MCP packages, and broadly exposing an access token.

Review this skill carefully before installing. Use project-scoped Qoder permissions instead of --yolo, avoid running unpinned npx MCP server commands, keep Qoder tokens out of globally inherited shell startup files, and audit any persistent Qoder agents, memory files, settings, MCP registrations, or background jobs it creates.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:75

Finding

Permission Controls Can Be Disabled Through Recommended YOLO Mode

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:75, with repeated recommendations at SKILL.md:93, SKILL.md:418, SKILL.md:546, and SKILL.md:576
Vulnerability Type: Permission bypass and excessive privileges
Risk Level: High

Vulnerable code:

bash

# Yolo mode (skip permissions)
bash workdir:~/project command:"qodercli --yolo -p 'Make the changes'"

The permission-denied troubleshooting guidance also recommends bypassing controls:

bash

### Permission Denied

```bash
# Use yolo mode (caution)
qodercli --yolo -p "task"

# Or configure permissions in ~/.qoder/settings.json

text

### Technical Analysis

The `--yolo` option explicitly skips Qoder CLI permission checks. The Skill presents this option in basic usage, the quick-reference material, and as a response to permission failures. This weakens the least-privilege boundary intended to constrain file access, shell execution, and other agent tools.

Coding tasks may legitimately require access to selected project files and build commands, but they do not normally require disabling all permission checks. Recommending a blanket bypass exceeds the minimum privileges necessary for the declared functionality.

The risk is amplified because Qoder processes natural-language prompts and repository content. Malicious instructions in source files, dependency metadata, `AGENTS.md`, or an MCP response could influence the agent to perform unintended operations. With permission checks disabled, those operations may proceed without user approval.

### Attack Path

1. An attacker places malicious or misleading instructions in a repository, dependency, generated file, `AGENTS.md`, or connected MCP response.
2. The user invokes Qoder against that workspace using the documented `--yolo` option, or enables it after encountering a permission-denied error.
3. Qoder interprets the attacker-controlled content as part of the task context.
4. The infl
...[truncated 795 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --yolo from basic usage, quick-reference, and troubleshooting guidance.
• Do not treat a permission failure as a reason to disable authorization controls.
• Use --allowed-tools to expose only the minimum required tools, such as read-only access for reviews or narrowly scoped write access for implementation tasks.
• Use --disallowed-tools=Bash when shell access is unnecessary.
• Define explicit allow rules for the target workspace and deny access to credentials, SSH material, shell configuration, cloud configuration, and unrelated directories.
• Require explicit, informed user confirmation before any exceptional permission bypass.
• Prefer a sandbox, container, or low-privilege operating-system account for agent execution.
• Document task-specific permission profiles rather than a universal unrestricted mode.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:256

Finding

Unpinned Remote npm Packages Are Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:256, SKILL.md:263-269
Vulnerability Type: Mutable remote dependency retrieval and execution
Risk Level: High

Vulnerable code:

bash

# Example: Playwright for browser control
bash command:"qodercli mcp add playwright -- npx -y @playwright/mcp@latest"

bash

# Context7 - Upstash context management
bash command:"qodercli mcp add context7 -- npx -y @upstash/context7-mcp@latest"

# DeepWiki - Wikipedia/knowledge access
bash command:"qodercli mcp add deepwiki -- npx -y mcp-deepwiki@latest"

# Chrome DevTools - Browser automation
bash command:"qodercli mcp add chrome-devtools -- npx chrome-devtools-mcp@latest"

Technical Analysis

These commands instruct npx to retrieve and execute packages from an external package registry. Three commands explicitly select @latest, while the Chrome DevTools command omits a version and therefore does not establish an immutable reviewed version.

The -y option suppresses the normal installation confirmation. Consequently, remote code can be downloaded and run without a separate dependency-review step. Because package contents associated with latest can change after this Skill has been audited, the effective executable payload is not fixed by the reviewed file.

Registering these commands as MCP servers may also create a persistent integration in Qoder configuration. A subsequently launched MCP process may receive agent requests and obtain whatever local or network access is available to the invoking user.

No evidence in the audited file proves that the named packages are currently malicious. The vulnerability is the unsafe, mutable supply-chain execution pattern and the absence of version and integrity controls.

Attack Path

1. A package publisher account or package release pipeline is compromised, a package is transferred to a malicious maintainer, or an unsafe future version is published.

...[truncated 1170 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every MCP package to a specific, reviewed version instead of using @latest or an omitted version.
• Verify package ownership, publisher provenance, release signatures, and official documentation before recommending installation.
• Use a lockfile and integrity-verified package installation process where possible.
• Avoid npx -y for first-time installation; require explicit user review and confirmation.
• Install dependencies in a sandbox or dedicated environment with minimal filesystem and environment access.
• Separate package installation from MCP registration so users can inspect the resolved package before execution.
• Periodically audit registered MCP servers and remove components that are no longer required.
• Restrict MCP processes from receiving authentication tokens or unrelated host environment variables.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:40

Finding

Long-Lived Access Token Is Placed in a Broadly Inherited Shell Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-47, with related guidance at SKILL.md:437, SKILL.md:475-497, and SKILL.md:569
Vulnerability Type: Excessive credential exposure through environment inheritance
Risk Level: Medium

Vulnerable code:

bash

# Environment variable (set in ~/.zshrc)
QODER_PERSONAL_ACCESS_TOKEN="your_token_here"

# Or check if already authenticated
qodercli status

The troubleshooting section additionally recommends:

bash

# Set environment variable
export QODER_PERSONAL_ACCESS_TOKEN="your_token"

The Skill states that environment variables are inherited automatically and that this behavior applies across session types.

Technical Analysis

The displayed token values are placeholders rather than embedded live credentials. However, the documented setup encourages users to place a personal access token in ~/.zshrc, which commonly causes the token to be inherited by every child process launched from the shell.

This exposure is broader than necessary. Qoder may require an authentication token, but unrelated build commands, package lifecycle scripts, npx packages, MCP servers, and agent-launched subprocesses do not need access to that credential.

Environment variables can also be exposed through debugging output, process inspection under applicable operating-system permissions, crash reports, accidental logging, or malicious dependencies. The document's statement that no credentials are exposed in chat does not address exposure to local subprocesses or external services invoked by those subprocesses.

The audited file contains no explicit command that transmits the token to a network endpoint. Therefore, direct credential exfiltration is not confirmed. The confirmed issue is avoidable expansion of the credential's exposure surface.

Attack Path

1. A user stores QODER_PERSONAL_ACCESS_TOKEN in ~/.zshrc or exports it in the active shell as i ...[truncated 1008 chars]

Remediation

View remediation

Remediation Suggestions

• Do not store personal access tokens in ~/.zshrc or other globally loaded shell startup files.
• Use an operating-system credential store, Qoder-supported credential helper, or dedicated secrets manager.
• Inject the token only into the individual Qoder process that requires it.
• Launch MCP servers and build tools with a sanitized environment that excludes QODER_PERSONAL_ACCESS_TOKEN.
• Use short-lived, narrowly scoped tokens with rotation and revocation support.
• Prevent environment-variable values from appearing in command output, diagnostic logs, crash reports, and agent context.
• Add explicit guidance for revoking a token after suspected exposure.
• Update the privacy section to distinguish chat-message secrecy from subprocess, logging, and network exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

"Edit(/Users/demo/projects/myproject/**)"
    ],
    "deny": [
      "Bash(rm -rf /**)"
    ]
  }
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

"Edit(/Users/demo/projects/myproject/**)"
    ],
    "deny": [
      "Bash(rm -rf /**)"
    ]
  }
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

"Edit(/Users/demo/projects/myproject/**)"
    ],
    "deny": [
      "Bash(rm -rf /**)"
    ]
  }
}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

md

"Bash(curl http://site.com/:*)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)"
    ]
  }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes --yolo with only minimal caution even though it disables permission checks for an AI coding tool that can edit files and run actions. In this context, reducing safeguards materially increases the chance of unintended or unsafe changes, especially when prompts or project content are adversarial.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

🎯 Quest Mode (Spec-Driven Development)

Quest Mode allows you to write specifications while AI automatically completes development tasks using subagents.

bash

# Quest mode via prompt

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

| qodercli jobs --worktree | List existing worktree jobs | | qodercli rm <jobId> | Remove a job (delete worktree) |

Create a Job

bash

# Basic worktree job (non-interactive)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP setup section tells users to add external servers via npx commands but does not clearly warn that these commands install and run third-party software and may contact the network. In an agent skill, this expands the execution boundary and can expose users to unreviewed code execution and data access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to add an MCP server via npx -y @playwright/mcp@latest, which pulls and executes whatever code is currently published under that package. Using an unpinned/latest package in a security-sensitive agent workflow creates a supply-chain risk: a malicious or compromised release could execute arbitrary code during installation or runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documented npx -y @upstash/context7-mcp@latest command fetches and runs third-party code without version pinning. In an automation skill, that makes behavior non-deterministic and exposes users to upstream package compromise or malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The npx -y mcp-deepwiki@latest example allows automatic installation/execution of the current latest package release. That creates a clear software supply-chain risk because users may unknowingly run compromised or changed code from the registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The chrome-devtools MCP example invokes npx chrome-devtools-mcp@latest without pinning a reviewed version. This makes the skill depend on mutable upstream code and increases the risk of arbitrary code execution if the package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.

md

],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)"
    ]
  }
}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Earlier sections repeatedly state that Qoder CLI must always be run in non-interactive Print mode with the -p flag, but the auto-notify example invokes qodercli --model=ultimate without -p. This is an active contradiction in the skill's own usage guidance, not merely an omitted detail, because the file treats -p as mandatory throughout.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

| `--model` | Model tier selection | `qodercli --model=ultimate` |
| `--max-turns` | Maximum dialog turns (0 = unlimited) | `qodercli --max-turns=10` |
| `--max-output-tokens` | Max tokens: 16k, 32k | `qodercli --max-output-tokens=32k` |
| `--yolo` | Skip permission checks | `qodercli --yolo` |
| `--allowed-tools` | Allow only specified tools | `qodercli --allowed-tools=READ,WRITE` |
| `--disallowed-tools` | Disallow specified tools | `qodercli --disallowed-tools=Bash` |
| `--agents` | JSON object defining custom agents | `qodercli --agents='{"reviewer":{...}}'` |

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.

md

| `--model` | Model tier selection | `qodercli --model=ultimate` |
| `--max-turns` | Maximum dialog turns (0 = unlimited) | `qodercli --max-turns=10` |
| `--max-output-tokens` | Max tokens: 16k, 32k | `qodercli --max-output-tokens=32k` |
| `--yolo` | Skip permission checks | `qodercli --yolo` |
| `--allowed-tools` | Allow only specified tools | `qodercli --allowed-tools=READ,WRITE` |
| `--disallowed-tools` | Disallow specified tools | `qodercli --disallowed-tools=Bash` |
| `--agents` | JSON object defining custom agents | `qodercli --agents='{"reviewer":{...}}'` |

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

6. **Initialize AGENTS.md** - helps Qoder understand project context
7. **Configure permissions** - set appropriate access rules per project
8. **Leverage subagents** - specialized agents for specific tasks
9. **Add MCP servers** - extend capabilities with external tools
10. **Works in all sessions** - environment variables are inherited automatically
11. **Use ultimate model for complex tasks** - refactoring, architecture, code review

Static analysis

No suspicious patterns detected.