Agent Dev Workflow

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:08 AM UTC
• Version: 1.2.0

Overview

This skill is a coding-agent orchestration workflow, but it asks users to run external agents with broad bypassed permissions and can modify project agent configuration.

Install only if you intentionally want a multi-agent coding workflow and are comfortable sending project context to Claude Code. Prefer running it in a sandboxed checkout, remove or avoid bypassPermissions unless a task truly requires it, review any CLAUDE.md or llmdoc changes before keeping them, and pin/review the required cc-plugin.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:13

Finding

Unrestricted Coding-Agent Execution Bypasses Least-Privilege Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17 and 130-135
Vulnerability Type: Agent execution with permission checks disabled
Risk Level: High

Vulnerable Code

markdown

## Prerequisites

- Claude Code (`claude` CLI) installed with `--permission-mode bypassPermissions --print`
- [cc-plugin](https://github.com/TokenRollAI/cc-plugin) installed in Claude Code (provides llmdoc read/write, investigator/scout/recorder sub-agents)
- Global `~/.claude/CLAUDE.md` configured with cc-plugin settings

markdown

#### 4.1 Prompt Construction

For each task, construct the agent prompt from the task card:

```bash
claude --permission-mode bypassPermissions --print '<task prompt>' 2>&1

text

### Technical Analysis

The workflow explicitly requires every coding-agent invocation to use `--permission-mode bypassPermissions`. This disables normal per-operation permission enforcement and violates least privilege. The documented `workdir` setting only selects a working directory; it is not an operating-system sandbox and does not prevent access to other files, credentials, processes, or network resources available to the parent process.

This becomes particularly dangerous because agent prompts are assembled from user requirements, project files, specifications, and task cards. Malicious or compromised input can consequently influence an agent that has broad command and filesystem capabilities.

### Attack Path

1. An attacker supplies a crafted coding requirement or places adversarial instructions in project content read during specification or task planning.
2. The workflow incorporates that content into a task card and agent prompt.
3. Phase 4 invokes Claude Code with `--permission-mode bypassPermissions`.
4. The influenced agent uses its available tools to execute commands or access files beyond the task's legitimate scope.
5. Because permission prompts are disabled, the operation proceeds without an authorization check
...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --permission-mode bypassPermissions from all recommended invocations.
• Use an explicit allowlist for required filesystem, command, and network operations.
• Require interactive confirmation for destructive commands, access outside the repository, credential access, and network activity.
• Run coding agents in an isolated container or sandbox with the target repository mounted as the only writable project path.
• Provide only short-lived, task-specific credentials when external services are required.
• Enforce OS-level resource boundaries because a working-directory setting alone is not a security boundary.
• Log and review agent tool calls, and stop execution when a command exceeds the confirmed task scope.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:130

Finding

Shell Command Injection Through Unescaped Task-Prompt Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 130-135
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

markdown

#### 4.1 Prompt Construction

For each task, construct the agent prompt from the task card:

```bash
claude --permission-mode bypassPermissions --print '<task prompt>' 2>&1

text

### Technical Analysis

The documented command places a dynamically constructed task prompt inside a single-quoted shell argument. Task prompts are derived from user requirements, specification text, and project content. The workflow does not require escaping, validation, an argument-array API, or stdin-based prompt delivery.

If an implementation substitutes prompt text into this command literally, an embedded single quote can terminate the quoted argument. Shell metacharacters following that quote can then be interpreted as commands or redirections by the shell rather than as prompt data.

For example, input shaped like the following could escape the intended argument in a literal shell-based implementation:

```text
' ; attacker-controlled-command ; #

The risk is amplified by the recommendation to execute the agent with permission checks disabled, although the shell injection itself occurs before Claude Code processes the prompt.

Attack Path

1. An attacker places a single quote and shell syntax in a coding requirement or in project content incorporated into a task prompt.
2. The orchestrator constructs the documented command by directly replacing <task prompt> with that content.
3. The injected quote closes the shell's original single-quoted argument.
4. The shell parses the remaining attacker-controlled text as command syntax.
5. The injected command executes with the privileges and environment of the workflow process.

This path applies when the command is implemented through shell-string interpolation as shown. An implementation using a process API with a fixed argument arr ...[truncated 700 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by concatenating or interpolating prompt text.
• Invoke Claude Code using a process API with a fixed executable and argument array, passing the entire prompt as one argument.
• Prefer passing the prompt through standard input or a securely created input file when prompts are large.
• Avoid shell=true, sh -c, bash -c, and equivalent command-string execution.
• If a shell is unavoidable, use a well-tested platform-specific escaping library rather than custom replacement logic.
• Add tests containing single quotes, command substitutions, newlines, redirections, and shell metacharacters to verify that all input remains inert data.
• Combine safe invocation with restricted agent permissions so that any residual command-construction defect has limited impact.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Plugin Is Executed Without Integrity Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17, 39-43, and 246-247
Vulnerability Type: Unpinned third-party execution dependency
Risk Level: Medium

Vulnerable Code

markdown

## Prerequisites

- Claude Code (`claude` CLI) installed with `--permission-mode bypassPermissions --print`
- [cc-plugin](https://github.com/TokenRollAI/cc-plugin) installed in Claude Code (provides llmdoc read/write, investigator/scout/recorder sub-agents)
- Global `~/.claude/CLAUDE.md` configured with cc-plugin settings

markdown

1. **`llmdoc/` exists?**
   - Yes → read `llmdoc/index.md` + overview files to understand project
   - No → dispatch Claude Code with `/tr:initDoc` to generate it first
2. **`CLAUDE.md` in project root?** — verify cc-plugin config is present; fix if missing

markdown

- **Never run agents in `~/.openclaw/`** — agents will read soul/identity files
- **Always update llmdoc** — every agent run should end with doc update

Technical Analysis

The workflow requires cc-plugin from a GitHub repository and relies on plugin-provided behavior, including sub-agents and commands such as /tr:initDoc and /update-doc. However, it does not specify:

• A reviewed version or immutable commit hash.
• A checksum or signature.
• A trusted release artifact.
• An update-review process.
• Isolation boundaries for plugin execution.

Consequently, the effective dependency code can change independently of the audited Skill. A compromised upstream repository, maintainer account, release process, or installation path could introduce altered behavior. The impact is increased because the same workflow recommends running Claude Code with permission checks bypassed and maintaining global ~/.claude/CLAUDE.md configuration.

This is a supply-chain weakness rather than proof that the named plugin is malicious.

Attack Path

1. An attacker compromises the upstream repository, maintainer account, distribution channel, or an unveri ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a reviewed immutable commit hash or signed release version.
• Publish and verify a cryptographic checksum for the exact installed artifact.
• Verify release signatures where the upstream project supports them.
• Document a reproducible installation procedure from a trusted source.
• Review source and release changes before upgrading the pinned version.
• Disable automatic updates for executable agent plugins.
• Run plugin commands in a sandbox with repository-scoped filesystem permissions and restricted network access.
• Avoid granting the plugin global configuration write access unless strictly necessary; back up and validate global configuration changes.
• Remove bypassPermissions so a dependency compromise does not automatically inherit unrestricted agent capabilities.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells operators to use bypass-permissions execution but does not provide an equivalent user-facing warning or consent gate about elevated filesystem and command access. This creates a dangerous mismatch between what the workflow can do and what a user may reasonably expect, especially since the skill is designed to process arbitrary coding tasks.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The skill is explicitly designed to route work to an external model/provider via the claude CLI, including arbitrary task prompts and repository context. In a coding workflow, this can exfiltrate sensitive code, secrets, or internal architecture to a third-party provider, and the risk is amplified by the broad triggers and bypass-permissions mode elsewhere in the skill.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

For each task, construct the agent prompt from the task card:

bash

claude --permission-mode bypassPermissions --print '<task prompt>' 2>&1

Task prompt structure:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are extremely broad, covering generic phrases like 'implement/build/fix this,' which can cause the skill to activate for routine requests without ensuring the user understands it may orchestrate external coding agents and modify project files. Overbroad activation increases the chance of unintended agent dispatch and unsafe operations in contexts that do not warrant them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly requires running Claude Code with --permission-mode bypassPermissions, which disables normal safety checks and grants broad filesystem and command execution capability to downstream agent tasks. In an orchestration skill that handles arbitrary coding requests and can dispatch multiple agents, this materially increases the blast radius of prompt mistakes, malicious repository content, or unsafe task prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The workflow describes automatic generation of llmdoc/ and repair of CLAUDE.md without clearly warning that project files and configuration may be created or modified. Users may invoke the skill expecting planning/orchestration help, but it can make persistent repository changes during setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt template includes the instruction "不要 git commit," which forces a non-English language in the agent instructions. The file does not offer a user language preference or explain why a Chinese-only instruction is required, so it violates the locale-choice policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The workflow instructs the operator to verify and 'fix' project-root CLAUDE.md configuration automatically, which authorizes modification of control/configuration files beyond the core coding task. Changing agent configuration can alter future agent behavior, persistence, or trust boundaries, making this more sensitive than ordinary source edits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown template forces a specific language/locale across headings and guidance text. Under the policy, language constraints should either offer user choice or be explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template headings and instructional text are written entirely in Chinese, which imposes a specific language on skill outputs and documentation. There is no indication that language selection is optional or that the template is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.