coding-agent-common

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:08 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible coding-agent helper, but it normalizes bypassing agent permission checks and unrestricted execution modes that deserve manual review before installation.

Install only if you are comfortable with a skill that may steer agents toward automatic or unrestricted coding-agent execution. Use it in disposable worktrees or containers, avoid --yolo, avoid Claude permission bypass unless explicitly intended, remove secrets from the environment, and manually review all changes before pushing or creating PRs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:44

Finding

Claude Code Is Configured to Bypass Permission Checks by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44-47, 59, 239; agents/openai.yaml:16; references/claude-code-commands.md:7-13, 21, 27, 42
Vulnerability Type: Permission bypass and violation of least privilege
Risk Level: High

Vulnerable Code

SKILL.md:44-47

bash

exec command:"claude --permission-mode bypassPermissions --print 'your task description'"

# Background execution
exec background:true command:"claude --permission-mode bypassPermissions --print 'your task description'"

references/claude-code-commands.md:7-13

bash

claude --permission-mode bypassPermissions --print "your prompt"
claude --permission-mode bypassPermissions --print "your prompt" &
cd /path/to/project && claude --permission-mode bypassPermissions --print "your prompt"

agents/openai.yaml:16

yaml

- Claude Code uses --print --permission-mode bypassPermissions

The English prompt placeholders above are direct translations of the corresponding placeholders in the source and do not alter command behavior.

Technical Analysis

The documentation consistently presents --permission-mode bypassPermissions as the normal way to launch Claude Code. This disables interactive permission enforcement for operations selected by the delegated agent.

A working directory limits the agent's initial context but is not an operating-system sandbox. Unless separate filesystem, process, credential, and network controls are imposed, the launched process retains the permissions of the parent account. Repository content, task instructions, or indirect prompt injection can therefore influence an agent that is authorized to perform actions without per-operation approval.

Attack Path

1. A user invokes the skill against a repository containing attacker-controlled files or instructions.
2. The skill launches Claude Code with --permission-mode bypassPermissions.
3. Claude Code reads the repo ...[truncated 668 chars]

Remediation

View remediation

Remediation Suggestions

• Use the standard permission mode by default and retain interactive approval for sensitive operations.
• Do not encode permission bypass as a default rule in agents/openai.yaml.
• Require explicit, informed user confirmation before enabling bypass mode for a specific invocation.
• Run delegated agents in an isolated container or sandbox with a read/write allowlist restricted to the intended repository.
• Remove unrelated credentials and sensitive environment variables from the child process.
• Deny network access by default and grant access only to explicitly approved destinations.
• Add command, filesystem, and network auditing so actions taken by the delegated agent remain reviewable.
• Treat repository instructions as untrusted input and instruct the agent not to follow repository-provided requests that expand task scope.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/codex-commands.md:10

Finding

Unrestricted Codex Execution Mode Is Documented as a Troubleshooting Option

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:129-132, 185; references/codex-commands.md:10-13, 46
Vulnerability Type: Unsandboxed and unapproved agent execution
Risk Level: High

Vulnerable Code

SKILL.md:129-132

markdown

| `exec "prompt"` | Run once and exit when complete |
| `--full-auto` | Sandbox mode with automatic approval for workspace changes |
| `--yolo` | No sandbox and no approval; fastest but most dangerous |

references/codex-commands.md:10-13

bash

codex exec --full-auto "your prompt"
codex exec --yolo "your prompt"

references/codex-commands.md:46

markdown

2. Interactive confirmation is required — use `--full-auto` or `--yolo`

The English descriptions and prompt placeholders above are direct translations of the source documentation.

Technical Analysis

The --yolo option explicitly removes both sandboxing and approval controls. Although SKILL.md:185 advises using --full-auto instead for sensitive projects, the command reference still presents --yolo as a solution when interactive confirmation is encountered.

This guidance creates a foreseeable escalation path from a constrained execution mode to unrestricted local execution. An AI coding agent processes untrusted repository content and generated instructions, so removing both containment and approval makes prompt injection or erroneous agent behavior equivalent to unrestricted command execution under the invoking account.

Attack Path

1. A user delegates work on an attacker-controlled or compromised repository.
2. Codex requests confirmation or cannot complete an operation under its existing restrictions.
3. The user or orchestrating agent follows the troubleshooting guidance and relaunches Codex with --yolo.
4. Malicious repository instructions or unsafe generated actions direct Codex to execute commands outside the intended workspace.
5. The commands run without san ...[truncated 429 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --yolo from operational examples and troubleshooting recommendations.
• Standardize on a sandboxed execution mode with the minimum required workspace permissions.
• Require explicit user approval that clearly states the loss of sandboxing before any unrestricted invocation.
• Prohibit automated agents from selecting or escalating to unrestricted mode.
• If unrestricted execution is exceptionally necessary, use a disposable container or virtual machine with no host credentials, restricted mounts, and blocked network access.
• Add policy checks that reject commands containing --yolo unless a separately authenticated exception is present.
• Update the troubleshooting section to resolve permission failures by narrowing the task or granting specific capabilities rather than disabling all controls.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:56

Finding

Untrusted Task Text Is Interpolated into Shell Command Strings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39, 44, 47, 56, 59, 66, 75-76, 195-196, 251; references/claude-code-commands.md:7-13, 42; references/codex-commands.md:7, 10, 13, 21
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

SKILL.md:56-59

bash

exec pty:true workdir:/path/to/project command:"codex exec --full-auto 'add error handling to API calls'"
exec workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'add error handling to API calls'"

SKILL.md:75-76

bash

exec pty:true workdir:/path/to/project background:true command:"codex exec 'fix issue #78'"
exec pty:true workdir:/path/to/project background:true command:"codex exec 'fix issue #99'"

references/claude-code-commands.md:42

bash

exec workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'refactor the user authentication module according to SOLID principles'"

The English task strings above are direct translations of the task text in the source. The vulnerable shell construction and quoting are unchanged.

Technical Analysis

The templates construct a single shell command and place task text inside shell quotes. If an implementation substitutes user-controlled task text directly into these templates, a matching quote can terminate the intended argument. Shell metacharacters can then append a new command.

For example, task text structurally equivalent to the following can escape a single-quoted prompt:

text

benign text'; attacker_command; #

After unsafe substitution, the shell can interpret the resulting value as the intended agent command followed by attacker_command. Quoting a variable in an example is not sufficient when the quoted content itself is assembled through string concatenation. The risk is amplified when the target agent is also launched with permission bypass or unrestricted exec ...[truncated 1053 chars]

Remediation

View remediation

Remediation Suggestions

• Invoke executables through a structured argument array rather than a shell command string. Pass the prompt as one discrete argument.
• Disable shell interpretation when launching Codex, Claude Code, OpenCode, or Pi.
• If the execution API cannot accept an argument array, apply rigorously tested, platform-specific escaping to every untrusted value.
• Do not use ad hoc replacement of quote characters as a security control.
• Reject NUL bytes and unexpected control characters, and enforce reasonable prompt-length limits.
• Keep command names and options constant; only the prompt argument should be variable.
• Add tests using single quotes, double quotes, semicolons, command substitutions, newlines, redirection operators, and platform-specific metacharacters.
• Combine safe argument handling with sandboxing and least privilege so a parsing failure does not provide unrestricted host access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

- GET /todos - 获取所有待办
- POST /todos - 创建待办
- PUT /todos/:id - 更新待办
- DELETE /todos/:id - 删除待办

要求：
1. 使用 Express.js

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

exec workdir:/tmp/issue-78 command:"git push -u origin fix/issue-78 && gh pr create --title 'fix: ...' --body '...'"

5. 清理

exec command:"git worktree remove /tmp/issue-78"

text

## 📊 进度更新规则

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/claude-code-commands.md (reported line 7)May include surrounding context.

bash

# 一次性执行（推荐）
claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/claude-code-commands.md (reported line 10)May include surrounding context.

md

claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

# 指定工作目录
cd /path/to/project && claude --permission-mode bypassPermissions --print "你的提示词"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/codex-commands.md (reported line 7)May include surrounding context.

bash

# 一次性执行
codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

codex exec --full-auto invokes an external coding agent in automatic approval mode, reducing human oversight over actions the model may take. In the context of a general-purpose coding-agent skill, this is more dangerous because users may apply it to real repositories or environments where unintended edits, command execution, or disclosure can occur quickly.

Content

Scanner excerpt · references/codex-commands.md (reported line 10)May include surrounding context.

md

codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

# 无限制模式（危险）
codex exec --yolo "你的提示词"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

codex exec --yolo is explicitly labeled dangerous and represents unrestricted execution with minimal safeguards. Within a coding-agent skill, exposing this as a routine command materially increases the risk of destructive changes, unsafe shell actions, or leakage of sensitive code and environment data if an agent follows the example.

Content

Scanner excerpt · references/codex-commands.md (reported line 13)May include surrounding context.

codex exec --full-auto "你的提示词"

无限制模式（危险）

codex exec --yolo "你的提示词"

text

## 代码审查

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/codex-commands.md (reported line 23)May include surrounding context.

codex review --base main

审查特定提交

codex exec "审查 commit abc123 的变更"

text

## 配置

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/codex-commands.md (reported line 28)May include surrounding context.

配置

配置文件位置：~/.codex/config.toml

toml

[model]

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown skill forces a specific language/locale in its user-facing description and operational guidance, with no indication that users may choose another language. Under the stated policy, a fixed language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly recommends running Claude Code with --permission-mode bypassPermissions, which disables an important safety control and allows the delegated coding agent to act without normal approval gates. In a general-purpose coding skill, this materially increases the chance of unintended code changes, secret exposure, or destructive actions if prompts, repositories, or downstream agent behavior are unsafe.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance says sensitive projects should use --full-auto rather than --yolo, but --full-auto still auto-approves workspace changes and is not an appropriate default for sensitive repositories. This framing may cause users to overtrust an autonomous mode in high-value environments where manual review and tighter controls are needed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The user-facing description and default prompt are written entirely in Chinese, which imposes a specific language on users without any opt-in or explanation that this skill is intended only for a Chinese-speaking context. The policy explicitly flags language or locale constraints when they are forced rather than optional or justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guidance explicitly recommends bypassing Claude Code permission checks and presents that mode as normal usage without any warning, constraints, or compensating controls. In a coding-agent skill, this is dangerous because the agent may execute filesystem or shell-affecting actions with reduced safeguards, increasing the chance of destructive changes, data exposure, or misuse if prompts or surrounding context are adversarial.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document advises users to use --full-auto or --yolo to bypass interactive confirmations, including in a troubleshooting section, without adequately explaining the operational risks. In a coding-agent skill, this increases the chance that an agent will execute destructive or privacy-impacting actions without human review, making unsafe automation more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content consistently assumes Chinese as the required language, and there is no indication that users may choose another language. Under the language/locale policy check, forcing a specific language without user opt-in is a policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file presents all instructional content in Chinese and does not indicate that the language choice is optional, user-selected, or required for a specific regional/compliance reason. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. The content appears to force a specific language without indicating user opt-in, alternatives, or a justified region-specific scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template instructs the agent/user to run a local shell command (openclaw system event --text ... --mode now) after task completion without any warning, consent gate, or clarification that this triggers a host-side command. In a coding-agent skill, this is more concerning because prompt templates may be reused broadly and can normalize automatic command execution, creating a pathway for unsafe local actions if task summaries or surrounding instructions become attacker-influenced.

Content

No source excerpt is available for this finding.