Lucky Coding Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.1

Overview

This skill is coherent as a coding-agent helper, but it normalizes no-approval agent execution and publishing actions without enough user-control safeguards.

Install only if you are comfortable with a skill that may cause agents to run broad coding commands. Avoid the documented `--yolo` workflows, do not pass untrusted issue text directly into shell command templates, and require human review before dependency installs, commits, pushes, PR comments, PR creation, or host notification commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:107

Finding

Unsandboxed Autonomous Coding Agent Execution

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The Skill recommends running a coding agent with `--yolo`, explicitly described as disabling both the sandbox and approval controls. These controls are security boundaries intended to prevent generated commands from obtaining unrestricted access to the invoking user's environment. Coding agents process potentially untrusted inputs, including repository files, issue descriptions, build output, and dependency metadata. A repository can therefore contain adversarial instructions that induce the agent to run commands outside the intended task. With sandboxing and approvals disabled, such commands can execute directly w ...[truncated 1699 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:19

Finding

Shell Command Injection Through Interpolated Agent Prompts

Content

View full analysis

. Commit and push.'" ``` ### Technical Analysis The documented templates construct a shell command as a string and place prompt or issue-description content inside single quotes. If an implementation replaces placeholders such as `Your prompt` or `` with untrusted text, a single quote can terminate the intended argument. Shell operators in the remaining text can then be interpreted by the shell rather than passed to the coding-agent executable. For example, an attacker-controlled description conceptually shaped like the following could break out of the quoted argument: ```text '; attacker_command; # ``` The exact exploit payload depends on how the surrounding tool serializes the `command` parameter, but the underlying vulnerability is direct interpolation of untrusted text into shell syntax. Using `--yolo` in the same workflow amplifies the impact by removing the coding agent's containment and approval controls, although the injected command itself may already be interpreted by the outer shell. ### Attack Path 1. An attacker controls or influences an issue title, issue description, task prompt, pull-request text, or other value used in place of a documented placeholder. 2. The value includes a quote terminator and shell control operators. 3. An orchestrator inserts the value directly into the ` ...[truncated 921 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:179

Finding

Unpinned Global Package Installation and Unsafe Dependency Execution

Content

View full analysis

. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The Skill recommends globally installing `@mariozechner/pi-coding-agent` without pinning a reviewed version or describing integrity and provenance verification. The package version resolved by the command can therefore change over time after the Skill itself has been audited. Global npm installation may execute package lifecycle scripts and places package-provided executables into a user-wide command path. If the package account, registry release process, or a transitive dependency is compromised, installation can execute attacker-controlled code with the invoking user's permissions. The `pnpm install` examples create an additional supply-chain exposure. Dependency installation can execute lifecycle scripts from the target repository's dependency graph. The history does not establish that any named dependency is malicious; the finding concerns the unsafe, unpinned, and insufficiently isolated installation wor ...[truncated 1417 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

## Codex CLI

**Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml)

### Flags

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

5. Cleanup

git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99

text

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Quick Start: One-Shot Tasks

For quick prompts/chats, create a temp git repo and run:

bash

# Quick chat (Codex needs a git repo!)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

--full-auto allows the agent to auto-approve workspace changes, reducing human oversight over edits and command effects. In a skill designed to delegate coding tasks, this weakens review boundaries and can enable unintended modifications at scale.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

| Flag            | Effect                                             |
| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill presents --full-auto and especially --yolo as normal workflow options, while only lightly noting danger and not establishing mandatory consent or scope restrictions. This normalizes autonomous code modification with reduced safeguards, increasing the chance of destructive edits, secret exposure, or unreviewed changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

Advertising --yolo as 'NO sandbox, NO approvals' explicitly endorses fully unsafeguarded execution by a delegated coding agent. In a coding skill, that materially increases the chance of arbitrary filesystem changes, secret access, and unintended command execution within the operator's environment.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

| --------------- | -------------------------------------------------- |
| `exec "prompt"` | One-shot execution, exits when done                |
| `--full-auto`   | Sandboxed but auto-approves in workspace           |
| `--yolo`        | NO sandbox, NO approvals (fastest, most dangerous) |

### Building/Creating

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

The example normalizes using codex exec --full-auto for building features without a mandatory approval checkpoint. That encourages autonomous changes directly in project directories and can lead to broad, unreviewed edits or dependency changes.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Building/Creating

bash

# Quick one-shot (auto-approves) - remember PTY!
bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'"

# Background for longer work

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill goes beyond delegating local coding work by instructing the agent to post GitHub comments and interact with PRs, which are external side effects on third-party systems. That expands the blast radius from local code assistance to networked actions that can publish data, alter collaboration state, or create unintended disclosures without an explicit approval boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

For fixing multiple issues in parallel, use git worktrees:

bash

# 1. Create worktrees for each issue
git worktree add -b fix/issue-78 /tmp/issue-78 main
git worktree add -b fix/issue-99 /tmp/issue-99 main

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The rule '--full-auto for building' makes auto-approval a normative recommendation rather than a narrowly controlled option. That increases the likelihood operators will delegate broad write authority to sub-agents without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

- If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over.
3. **Be patient** - don't kill sessions because they're "slow"
4. **Monitor with process:log** - check progress without interfering
5. **--full-auto for building** - auto-approves changes
6. **vanilla for reviewing** - no special flags needed
7. **Parallel is OK** - run many Codex processes at once for batch work
8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The auto-notify section instructs spawned agents to execute a host-level openclaw system event command on completion, which is unrelated to core coding delegation and introduces an out-of-band signaling capability. A delegated agent that can emit host events can spoof completion, leak status data, or trigger unintended orchestration behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions to post PR comments and push branches omit a clear warning that these are external write actions affecting remote repositories and visible collaboration artifacts. Without disclosure and approval requirements, an operator may treat them as routine local steps and unintentionally publish sensitive or incorrect content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The completion hook triggers a host/system event but does not clearly warn that this is a privileged side effect outside the delegated coding task. That can mislead operators into embedding host control commands in prompts without recognizing the trust and integrity implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.