ClawHub
Back to skill

Security audit

CodeBuddy Code for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent CodeBuddy CLI usage guide, with normal but real risks from global npm installation and an optional permission-bypass mode.

Install only if you trust the CodeBuddy npm package and publisher. Prefer a pinned reviewed version where possible, avoid running npm or CodeBuddy with administrator privileges, use default or plan permissions for normal projects, and reserve `-y` or `bypassPermissions` for disposable sandboxes with recoverable files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Global Installation of a Third-Party Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–25 and 84–88
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
## Installation

```bash
# Check prerequisites
node -v  # Requires Node.js 18+
npm -v

# Install globally
npm install -g @tencent-ai/codebuddy-code

# Verify
codebuddy --version
text

The update instructions repeat the same unpinned installation:

```bash
## Update

```bash
npm install -g @tencent-ai/codebuddy-code
text

### Technical Analysis

The Skill directs users to install the latest available release of `@tencent-ai/codebuddy-code` globally. It does not specify a reviewed version, integrity hash, lockfile, package provenance check, or trusted registry configuration.

Because the package implementation is not included in the audited project, its install-time and runtime behavior cannot be verified from this repository. A global npm installation may execute package lifecycle scripts with the permissions of the invoking user and places executable files in a shared system or user-level npm location.

The package scope is consistent with the vendor named by the Skill, and the file does not reference a suspicious registry or download domain. Therefore, this is a supply-chain hardening weakness rather than evidence that the named package is malicious.

### Attack Path

1. An attacker compromises the package publisher account, npm package, release pipeline, or another component in the package's dependency chain.
2. The attacker publishes a malicious or compromised package version under the same package name.
3. A user follows the Skill's installation or update command.
4. npm resolves the command to the latest mutable release because no version is pinned.
5. Malicious lifecycle code or the installed CLI executes with the user's npm and operating-system permissions.
6. The compromised pack
...[truncated 824 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a specific, reviewed version, for example:
    bash
    npm install -g @tencent-ai/codebuddy-code@<reviewed-version>
  2. Document how users can verify the package publisher, registry, provenance attestations, and integrity metadata before installation.
  3. Prefer a project-local installation with a committed lockfile over a global installation where feasible.
  4. Disable npm lifecycle scripts during initial inspection when operationally possible, and review required scripts before enabling them.
  5. Run the CLI in a container or restricted development environment with only the required project directory mounted.
  6. Avoid running npm or the installed CLI with administrative privileges.
  7. Establish a controlled update process that reviews release notes, dependency changes, checksums, and provenance before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:35
Finding

Permission Confirmation Bypass Exposed in Usage Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–42 and 50–57
Vulnerability Type: Unsafe permission-bypass configuration
Risk Level: Medium

Vulnerable Code

markdown
## CLI Arguments

| Argument | Description |
|----------|-------------|
| `codebuddy "<prompt>"` | Execute single task |
| `-y` / `--dangerously-skip-permissions` | Skip permission confirmations (sandbox only) |
| `-p` / `--print` | Single execution mode (requires `-y` for file ops) |
| `--permission-mode <mode>` | `acceptEdits`, `bypassPermissions`, `default`, `plan` |
| `--version` | Show version |

The Skill also provides a directly reusable bypass example:

bash
# Skip permissions (sandbox only)
codebuddy -p "Review code quality" -y

Technical Analysis

The -y or --dangerously-skip-permissions option disables permission confirmations, while the documented bypassPermissions mode indicates another mechanism for removing normal authorization prompts. The example combines non-interactive execution with the permission bypass, enabling file operations without per-action approval.

Permission confirmations are a security boundary between model-generated actions and actual workspace modifications. Removing that boundary makes it possible for erroneous, overly broad, or adversarially influenced instructions to perform operations beyond the user's intended scope.

The document explicitly limits this option to sandboxes and warns on line 92 that it can cause file deletion, scope creep, and data loss and must not be used in production. Those warnings reduce the likelihood of accidental misuse and show no malicious intent, but they do not technically enforce isolation or prevent users from copying the command into a sensitive workspace.

Attack Path

  1. A user copies the documented codebuddy -p "Review code quality" -y pattern.
  2. The command is run in a real project, home directory, or ...[truncated 1515 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the directly reusable -y example from the default workflow.
  2. Recommend plan or default permission mode as the standard configuration.
  3. Require explicit approval for file writes, deletions, command execution, network access, and operations outside the project root.
  4. If bypass mode must remain documented, provide an enforceable isolation checklist requiring:
    • A disposable container or virtual machine.
    • A non-privileged user.
    • No host credentials or sensitive environment variables.
    • No unrestricted home-directory mount.
    • A narrowly scoped project mount.
    • Restricted or disabled outbound network access.
    • A recoverable copy of all input files.
  5. Add a prominent warning immediately before every bypass command rather than relying only on the final Security Notes section.
  6. Prefer read-only mounts for review-only tasks.
  7. Document that untrusted repository content may influence AI-generated actions and must not be processed with permission checks disabled.

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
| `/status` | Show account info and current model |
| `/login` | Switch accounts |
| `/logout` | Sign out |
| `/clear` | Reset conversation history |
| `/exit` | End session |
| `/config` | Open configuration |
| `/doctor` | Diagnose issues |

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
## Custom Commands

Create `.md` files in:
- **Project**: `.codebuddy/commands/`
- **Global**: `~/.codebuddy/commands/`

Static analysis

No suspicious patterns detected.