CodeBuddy CLI for OpenClaw

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:25 AM UTC
• Version: 1.0.0

Overview

This is a straightforward CodeBuddy CLI usage guide with disclosed but potentially risky options users should handle carefully.

Before installing, verify the npm package and publisher, avoid running npm or CodeBuddy with elevated privileges, and use default or plan permission modes for normal projects. Treat --dangerously-skip-permissions and bypassPermissions as disposable-sandbox-only options because they can allow file changes or deletion without confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20 and 86
Vulnerability Type: Unpinned global npm dependency
Risk Level: Medium

Vulnerable code at line 20:

bash

npm install -g @tencent-ai/codebuddy-code

Repeated update command at line 86:

bash

npm install -g @tencent-ai/codebuddy-code

Technical Analysis

The installation and update instructions retrieve the latest available version of @tencent-ai/codebuddy-code without pinning a reviewed version or verifying package integrity or provenance. npm packages can execute lifecycle scripts during installation, and the installed CLI subsequently executes with the privileges of the invoking user.

The global -g installation increases the exposure beyond a single project. If the package, publisher account, registry resolution, or a future release is compromised, following either command could install and execute attacker-controlled code. No malicious behavior in the named package itself was established by this audit; the vulnerability is the unsafe, mutable dependency installation procedure.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a future release in its distribution channel.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the documented installation or update command.
4. npm resolves the unpinned package name to the attacker-controlled latest version.
5. Malicious lifecycle scripts or CLI code execute under the user's account.
6. The code can access or modify resources available to that account.

Impact Assessment

Successful exploitation provides code execution with the invoking user's operating-system privileges. The potential scope includes user-readable source code, credentials available in the environment, writable project files, user configuration, and other resources accessible to the account. A privileged installation ...[truncated 100 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation instructions to a specifically reviewed package version.
• Verify the expected npm registry, package publisher, provenance attestations, and release integrity before installation.
• Prefer a project-local dependency with a committed lockfile over a global installation where feasible.
• Use npm security controls that restrict lifecycle scripts when they are not required.
• Test upgrades in an isolated environment before recommending them to users.
• Document a controlled upgrade process instead of automatically retrieving the latest release.
• Warn users not to run npm installation commands with elevated operating-system privileges.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:35

Finding

AI File Operations Can Bypass Permission Confirmations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-39 and 50-53
Vulnerability Type: Permission and access-control bypass
Risk Level: Medium

Documented permission-bypass options at lines 35-39:

markdown

| Argument | Description |
|----------|-------------|
| `codebuddy "<prompt>"` | Execute single task |
| `-y` / `--dangerously-skip-permissions` | Skip permission confirmations (sandbox only) |
| `-p` / `--print` | Single execution mode (requires `-y` for file ops) |
| `--permission-mode <mode>` | `acceptEdits`, `bypassPermissions`, `default`, `plan` |

Permission-bypass example at lines 50-53:

bash

# Skip permissions (sandbox only)
codebuddy -p "Review code quality" -y

The Skill also includes the following warning at lines 90-92:

markdown

## Security Notes

`--dangerously-skip-permissions` risks: file deletion, scope creep, data loss. **Never use in production.**

Technical Analysis

The -y or --dangerously-skip-permissions option disables permission confirmation for AI-directed file operations. The documented bypassPermissions mode has a comparable least-privilege concern. This removes the interactive control that would otherwise allow a user to reject unintended, excessive, or destructive actions.

The Skill correctly labels the option as dangerous, limits its intended use to sandboxes, and warns against production use. However, the supplied command does not technically verify or create an isolated sandbox. A user can therefore copy the example into a normal project or environment where the CLI has access to sensitive or valuable files.

Attack Path

1. A user enters a normal project directory that is not strongly isolated.
2. The user copies the example using -y, or selects bypassPermissions.
3. The AI assistant generates an incorrect, excessive, or destructive file operation while performing the task.
4. Permission con ...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

• Remove -y from routine examples and use the default or plan permission mode.
• Require explicit user approval before file modification, deletion, command execution, or access outside the intended project.
• If bypass mode must be documented, provide a concrete isolation procedure using a disposable container or virtual machine.
• Restrict sandbox filesystem mounts to a disposable working copy and exclude credentials, home directories, SSH configuration, and production data.
• Apply network restrictions and a non-privileged runtime account inside the sandbox.
• Add a verification step confirming that the environment is disposable before presenting the bypass command.
• Prefer narrowly scoped acceptEdits behavior over unrestricted bypassPermissions.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

| `/status` | Show account info and current model |
| `/login` | Switch accounts |
| `/logout` | Sign out |
| `/clear` | Reset conversation history |
| `/exit` | End session |
| `/config` | Open configuration |
| `/doctor` | Diagnose issues |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

## Custom Commands

Create `.md` files in:
- **Project**: `.codebuddy/commands/`
- **Global**: `~/.codebuddy/commands/`

Static analysis

No suspicious patterns detected.