T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:174- Finding
Unattended Agent Execution Can Modify and Publish Repository Content Without Review
- Content
View full analysis
- Remediation
View remediation
Security audit
Cursor CLI Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparent about delegating coding work, but it repeatedly encourages unattended agents that can edit, commit, and push code without a review checkpoint.
Install only if you are comfortable delegating repository edits to Cursor Agent. Prefer --plan or interactive mode first, use isolated temporary worktrees, inspect git status and diffs before committing, and require a separate explicit decision before any push or PR creation. Avoid --yolo, --trust, background execution, and broad project directories unless you understand the account and credential access available to the agent.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text ---
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill's safety boundary is inconsistent: metadata explicitly says to never spawn agents in ~/clawd workspace, but the later rules only forbid ~/.openclaw/. That contradiction can cause an operator or downstream agent to treat the narrower path as the real restriction and run a powerful coding agent in a sensitive workspace the top-level description intended to protect.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill says PR reviews should be done in a temp directory for isolation, but the later batch-review example launches review agents in ~/project. This undermines the documented isolation model and may expose unrelated local code or secrets to the reviewing agent while allowing accidental writes in a non-ephemeral workspace.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 70% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
For longer tasks, use background mode:
bash # Start background task bash pty:true workdir:~/project background:true command:"agent --yolo 'Refactor the auth module'" # Returns sessionId, monitor with process tool
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
Documenting a --yolo/--force flag that auto-approves all operations enables autonomous decision-making by the coding agent with reduced oversight. In this skill context, that increases the chance of unintended file, git, or shell actions being carried out before a user can review them.
- Content
md | Flag | Description | |------|-------------| | `prompt` | Initial prompt for the agent | | `--yolo` / `--force` | Auto-approve all operations (dangerous but fast) | | `--model <model>` | Specify model (gpt-5, sonnet-4, opus-4, gemini, grok, etc.) | | `--workspace <path>` | Working directory | | `-w, --worktree [name]` | Run in isolated git worktree |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 55% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | `--mode <mode>` | Execution mode: plan (read-only planning), ask (Q&A) | | `--plan` | Plan mode (read-only, no file modifications) | | `--cloud` | Cloud mode | | `--resume` | Resume previous session | | `--trust` | Trust workspace (headless mode only) | ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The dedicated 'Auto-Execute Mode (--yolo)' section promotes autonomous execution of coding tasks in a real project directory. Because this skill is specifically for delegating code changes, the example materially increases the risk of unsupervised repository modifications rather than describing a harmless capability.
- Content
bash pty:true workdir:~/project command:"agent 'Build a dark mode toggle'"
text ### Auto-Execute Mode (--yolo) ```bash # Auto-approve all operations, fast execution bash pty:true workdir:~/project command:"agent --yolo 'Refactor the auth module'"
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The example explicitly frames auto-approve as a fast execution path, which encourages bypassing review controls. In a tool that can edit files and run commands, this can lead to unintended destructive or security-impacting changes with little friction.
- Content
Auto-Execute Mode (--yolo)
bash # Auto-approve all operations, fast execution bash pty:true workdir:~/project command:"agent --yolo 'Refactor the auth module'"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example instructs the agent to auto-approve changes, commit, and push to origin without an explicit warning or human checkpoint. In a coding-agent skill, that can directly modify repositories and publish unintended or unsafe code, making the side effects materially dangerous rather than merely illustrative.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The rules section elevates '--yolo for building' to a normative recommendation, effectively making auto-approval part of the expected workflow. That guidance is dangerous in this context because it nudges operators toward unattended code changes by a powerful external agent.
- Content
md 1. **Always use pty:true** - Will hang without PTY 2. **Use background for long tasks** - Don't block main thread 3. **--yolo for building** - Auto-approve changes 4. **--plan for reviewing** - Read-only analysis 5. **--print for scripting** - Non-interactive, parseable output 6. **Use -w worktree for isolation** - Parallel task processing
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The completion-notification example tells the spawned agent to execute a host command when it finishes. Even though the example is for notification, it normalizes agent-directed host command execution and could be repurposed for arbitrary commands if copied without scrutiny.
- Content
Static analysis
No suspicious patterns detected.