T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:23- Finding
Delegated Agents Are Instructed to Bypass Permission Controls and Sandboxing
- Content
View full analysis
- Remediation
View remediation
Security audit
Coding Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real coding-agent delegation guide, but it routinely encourages bypassed approvals, unsandboxed execution, and remote repository actions that users should review carefully before installing.
Install only if you understand that this skill can lead your agent to launch other coding agents with broad file, command, network, and repository authority. Use it in disposable worktrees or containers, avoid --yolo and permission-bypass modes unless explicitly intended, do not paste untrusted issue text into shell commands, and review before any commit, push, PR comment, or global package install.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:214- Finding
Unescaped Task Text Can Break Out of Shell-Quoted Agent Commands
- Content
View full analysis
. Commit and push.'" bash pty:true workdir:/tmp/issue-99 background:true command:"pnpm install && codex --yolo 'Fix issue #99 from the approved ticket summary. Implement only the in-scope edits and commit after review.'" ``` Other representative examples use the same nested shell-string pattern: ```bash bash pty:true command:"codex exec 'Your prompt'" ``` ```bash bash workdir:~/project command:"claude --permission-mode bypassPermissions --print 'Your task'" ``` ### Technical Analysis The Skill places task descriptions and prompts inside single quotes embedded in a larger shell command string. It does not specify validation, escaping, or argument-array handling before substituting values such as ``, `Your prompt`, or `Your task`. If attacker-controlled issue text, pull-request text, repository content, or user input is inserted directly into these templates, a single quote can terminate the intended prompt argument. Shell metacharacters following that quote can then be interpreted as a separate command. For example, a malicious description structurally resembling the following could escape the prompt argument: ```text Update documentation'; attacker-command; # ``` After unsafe substitution, the command would be parsed as the intended agent invocation followed by an attacker-selected shell command. The exact payload is environment-dependent, but the quoting boundary is insufficient for arbitrary untrusted task text. This issue is especially serious in examples that combine command-string interpolation with `--yolo` or permission-b ...[truncated 1503 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:190- Finding
Unpinned Global Installation of a Third-Party Coding Agent
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Codex CLI **Model:** `gpt-5.2-codex` is the default (set in ~/.codex/config.toml) ### Flags
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
gh pr create --repo user/repo --head fix/issue-78 --title "fix: ..." --body "..."
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Cleanup
git worktree remove /tmp/issue-78 git worktree remove /tmp/issue-99
text ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Claude Code guidance instructs use of
--permission-mode bypassPermissions, which disables an important safeguard, but the text frames it as the correct approach rather than a high-risk exception. This encourages routine permission bypass and lowers operator caution around potentially dangerous file and command actions.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Quick Start: One-Shot Tasks
For quick prompts/chats, create a temp git repo and run:
bash # Quick chat (Codex needs a git repo!)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The statement that
workdirmeans the agent 'sees only this folder's context' is misleading because the documented commands also allow broader filesystem and network actions, including elevated execution and unsandboxed modes. This can cause operators to overtrust directory scoping and launch agents under a false assumption of confinement.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The
--full-autoflag is described as auto-approving changes, which delegates decision-making about modifications to the coding agent without review at execution time. While safer than--yolo, it still creates a real risk of unintended edits or actions when used as a recommended default for building tasks.- Content
md | Flag | Effect | | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill recommends
--full-autoand documents--yoloas available behavior without requiring a strong user warning at the point of use. Auto-approved or no-approval execution enables unattended code and environment changes, increasing the chance of destructive edits, data exposure, or unintended command execution.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
Documenting
--yoloas 'NO sandbox, NO approvals' and associating it with speed makes fully autonomous unsandboxed execution an endorsed workflow. In a coding-agent skill, that materially increases the chance of arbitrary system changes, secret exposure, or destructive actions beyond the project boundary.- Content
md | --------------- | -------------------------------------------------- | | `exec "prompt"` | One-shot execution, exits when done | | `--full-auto` | Sandboxed but auto-approves in workspace | | `--yolo` | NO sandbox, NO approvals (fastest, most dangerous) | ### Building/Creating
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The example actively demonstrates
codex exec --full-autofor feature building, operationalizing autonomous approvals rather than merely mentioning them. This makes risky unattended modification behavior easy to copy-paste into real projects without a balancing warning.- Content
Building/Creating
bash # Quick one-shot (auto-approves) - remember PTY! bash pty:true workdir:~/project command:"codex exec --full-auto 'Build a dark mode toggle'" # Background for longer work
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples normalize autonomous remote side effects such as posting GitHub comments, committing, and pushing changes without a clear warning that these actions modify external systems and may disclose data. In a delegation skill, this can lead to accidental publication of sensitive code, noisy automation, or unauthorized repository activity.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
For fixing multiple issues in parallel, use git worktrees:
bash # 1. Create worktrees for each issue git worktree add -b fix/issue-78 /tmp/issue-78 main git worktree add -b fix/issue-99 /tmp/issue-99 main
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The rule '
--full-auto for building' institutionalizes autonomous approvals as standard practice for creation tasks. That increases risk because build tasks often involve dependency changes, file creation, test execution, and command invocation that can have broader effects than users expect.- Content
md - If an agent fails/hangs, respawn it or ask the user for direction, but don't silently take over. 3. **Be patient** - don't kill sessions because they're "slow" 4. **Monitor with process:log** - check progress without interfering 5. **--full-auto for building** - auto-approves changes 6. **vanilla for reviewing** - no special flags needed 7. **Parallel is OK** - run many Codex processes at once for batch work 8. **NEVER start Codex in ~/.openclaw/** - it'll read your soul docs and get weird ideas about the org chart!
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs delegated coding agents to invoke
openclaw system eventon the host when they finish, which expands the agent's capability from code editing into host-level signaling. That creates an unintended cross-boundary side effect channel and could be abused to generate spoofed notifications, trigger orchestration behavior, or mask malicious activity as normal completion events.- Content
Static analysis
No suspicious patterns detected.