Coding Agent

• Analyzed: Mar 23, 2026, 1:26 AM
• Findings: 1
• Version: 1.0.1
• Hash: 7246c8eefba7814bf992f6f6e85ef86bfb24b2cd779a2ede5082bc3a8a1286d0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides instructions for delegating tasks to external AI agents (Codex, Claude Code, etc.) using high-risk execution flags such as `--yolo` (disabling sandboxes and approvals) and `--permission-mode bypassPermissions` in SKILL.md. While these capabilities are aligned with the stated goal of autonomous coding, they represent a significant security risk by allowing sub-agents to execute arbitrary shell commands without user intervention. The instructions also detail how to manage background processes and PTY sessions, which are powerful primitives that could be abused if the agent receives a malicious prompt.