T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:23- Finding
Permission Controls and Sandboxing Disabled for Delegated Coding Agents
- Content
View full analysis
- Remediation
View remediation
Security audit
Coding Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed coding-agent launcher, but it repeatedly recommends running delegated agents with disabled approvals or sandboxing in ways users should review carefully before installing.
Install only if you are comfortable supervising delegated coding agents that may run with broad local authority. Prefer sandboxed modes, disposable clones or containers, pinned dependencies, and separate human review before commits, pushes, PR comments, or any command that uses local credentials.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:214- Finding
Unpinned and Potentially Script-Executing Dependency Installation
- Content
View full analysis
. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` ### Technical Analysis The Skill recommends globally installing a third-party npm package without an exact version or integrity verification. An unpinned global installation resolves whichever package version the configured registry currently serves, allowing future package compromise or registry manipulation to alter the executed code after the Skill has been reviewed. The parallel issue workflow also runs `pnpm install` against repository-controlled dependency metadata. Package managers may execute dependency lifecycle scripts during installation. Consequently, a malicious package, compromised transitive dependency, manipulated lockfile, or hostile repository manifest can execute code before the coding agent begins its work. The subsequent use of `codex --yolo` compounds this exposure by continuing the workflow without sandbox or approval protections, although package lifecycle scripts can already execute independently during `pnpm install`. ### Attack Path 1. An attacker compromises the referenced package, one of the project's direct or transitive dependencies, a package registry account, or dependency metadata in the target repository. 2. The user follows the documented workflow and runs the unpinned global npm installation or `pnpm install`. 3. The package manager resolves and downloads attacker-controlled content. ...[truncated 1331 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Codex CLI **Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml) ### Flags
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill recommends
claude --permission-mode bypassPermissions --printas the correct way to run Claude Code, effectively disabling permission checks for a delegated coding agent. Although the text mentions an alternative failure mode, it does not provide an adequate safety warning or compensating controls for granting unrestricted tool access.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Quick Start: One-Shot Tasks
For quick prompts/chats, create a temp git repo and run:
bash # Quick chat (Codex needs a git repo!)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill describes
--full-autoas auto-approving changes in the workspace, which reduces human oversight over agent actions. While less severe than--yolobecause it remains sandboxed, it still encourages autonomous modifications that can introduce unsafe or unintended changes.- Content
md | Flag | Effect | | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
Documenting
--yoloas 'NO sandbox, NO approvals' endorses fully autonomous execution without safety interlocks. In the context of a coding-agent skill that spawns background processes in real project directories, this materially increases the risk of destructive edits, data exposure, or unintended command execution.- Content
md | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
This concrete example operationalizes
--full-autofor building in a real project directory, normalizing unattended code changes. The danger is amplified because examples are likely to be copied verbatim by operators, turning reduced-oversight behavior into the default workflow.- Content
Building/Creating
bash # Quick one-shot (auto-approves) - remember PTY! bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'" # Background for longer work
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
For fixing multiple issues in parallel, use git worktrees:
bash # 1. Create worktrees for each issue git worktree add -b fix/issue-78 /tmp/issue-78 main git worktree add -b fix/issue-99 /tmp/issue-99 main
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The rules section explicitly recommends
--full-auto for building, reinforcing autonomous approval as standard operating procedure. Repetition in policy-style guidance makes misuse more likely and weakens operator caution around agent autonomy.- Content
md - If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over. 3. **Be patient** - don't kill sessions because they're "slow" 4. **Monitor with process:log** - check progress without interfering 5. **--full-auto for building** - auto-approves changes 6. **vanilla for reviewing** - no special flags needed 7. **Parallel is OK** - run many Codex processes at once for batch work 8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs spawned agents to run
openclaw system eventon completion, which is unrelated host-control functionality rather than task-local coding work. This creates an unintended command-execution bridge from the delegated agent back into the orchestrator environment, enabling spoofed completion signals or abuse of host capabilities if the agent follows or mutates that instruction.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The documentation claims
workdirkeeps the agent focused and limits wandering, but elsewhere recommends permissive modes such as--yoloand bypass-permissions that undermine that implied boundary. This can mislead operators into believing directory scoping is a meaningful security control when the agent may still act with broad authority.- Content
Static analysis
No suspicious patterns detected.