coding-agent-common

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:08 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible coding-agent helper, but it normalizes bypassing agent permission checks and unrestricted execution modes that deserve manual review before installation.

Install only if you are comfortable with a skill that may steer agents toward automatic or unrestricted coding-agent execution. Use it in disposable worktrees or containers, avoid --yolo, avoid Claude permission bypass unless explicitly intended, remove secrets from the environment, and manually review all changes before pushing or creating PRs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:44
• Finding: Claude Code Is Configured to Bypass Permission Checks by Default## Vulnerability Details **File Location**: `SKILL.md:44-47, 59, 239`; `agents/openai.yaml:16`; `references/claude-code-commands.md:7-13, 21, 27, 42` **Vulnerability Type**: Permission bypass and violation of least privilege **Risk Level**: High ### Vulnerable Code `SKILL.md:44-47` ```bash exec command:"claude --permission-mode bypassPermissions --print 'your task description'" # Background execution exec background:true command:"claude --permission-mode bypassPermissions --print 'your task description'" ``` `references/claude-code-commands.md:7-13` ```bash claude --permission-mode bypassPermissions --print "your prompt" claude --permission-mode bypassPermissions --print "your prompt" & cd /path/to/project && claude --permission-mode bypassPermissions --print "your prompt" ``` `agents/openai.yaml:16` ```yaml - Claude Code uses --print --permission-mode bypassPermissions ``` The English prompt placeholders above are direct translations of the corresponding placeholders in the source and do not alter command behavior. ### Technical Analysis The documentation consistently presents `--permission-mode bypassPermissions` as the normal way to launch Claude Code. This disables interactive permission enforcement for operations selected by the delegated agent. A working directory limits the agent's initial context but is not an operating-system sandbox. Unless separate filesystem, process, credential, and network controls are imposed, the launched process retains the permissions of the parent account. Repository content, task instructions, or indirect prompt injection can therefore influence an agent that is authorized to perform actions without per-operation approval. ### Attack Path 1. A user invokes the skill against a repository containing attacker-controlled files or instructions. 2. The skill launches Claude Code with `--permission-mode bypassPermissions`. 3. Claude Code reads the repo ...[truncated 668 chars]
• Remediation: ## Remediation Suggestions - Use the standard permission mode by default and retain interactive approval for sensitive operations. - Do not encode permission bypass as a default rule in `agents/openai.yaml`. - Require explicit, informed user confirmation before enabling bypass mode for a specific invocation. - Run delegated agents in an isolated container or sandbox with a read/write allowlist restricted to the intended repository. - Remove unrelated credentials and sensitive environment variables from the child process. - Deny network access by default and grant access only to explicitly approved destinations. - Add command, filesystem, and network auditing so actions taken by the delegated agent remain reviewable. - Treat repository instructions as untrusted input and instruct the agent not to follow repository-provided requests that expand task scope.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/codex-commands.md:10
• Finding: Unrestricted Codex Execution Mode Is Documented as a Troubleshooting Option## Vulnerability Details **File Location**: `SKILL.md:129-132, 185`; `references/codex-commands.md:10-13, 46` **Vulnerability Type**: Unsandboxed and unapproved agent execution **Risk Level**: High ### Vulnerable Code `SKILL.md:129-132` ```markdown | `exec "prompt"` | Run once and exit when complete | | `--full-auto` | Sandbox mode with automatic approval for workspace changes | | `--yolo` | No sandbox and no approval; fastest but most dangerous | ``` `references/codex-commands.md:10-13` ```bash codex exec --full-auto "your prompt" codex exec --yolo "your prompt" ``` `references/codex-commands.md:46` ```markdown 2. Interactive confirmation is required — use `--full-auto` or `--yolo` ``` The English descriptions and prompt placeholders above are direct translations of the source documentation. ### Technical Analysis The `--yolo` option explicitly removes both sandboxing and approval controls. Although `SKILL.md:185` advises using `--full-auto` instead for sensitive projects, the command reference still presents `--yolo` as a solution when interactive confirmation is encountered. This guidance creates a foreseeable escalation path from a constrained execution mode to unrestricted local execution. An AI coding agent processes untrusted repository content and generated instructions, so removing both containment and approval makes prompt injection or erroneous agent behavior equivalent to unrestricted command execution under the invoking account. ### Attack Path 1. A user delegates work on an attacker-controlled or compromised repository. 2. Codex requests confirmation or cannot complete an operation under its existing restrictions. 3. The user or orchestrating agent follows the troubleshooting guidance and relaunches Codex with `--yolo`. 4. Malicious repository instructions or unsafe generated actions direct Codex to execute commands outside the intended workspace. 5. The commands run without san ...[truncated 429 chars]
• Remediation: ## Remediation Suggestions - Remove `--yolo` from operational examples and troubleshooting recommendations. - Standardize on a sandboxed execution mode with the minimum required workspace permissions. - Require explicit user approval that clearly states the loss of sandboxing before any unrestricted invocation. - Prohibit automated agents from selecting or escalating to unrestricted mode. - If unrestricted execution is exceptionally necessary, use a disposable container or virtual machine with no host credentials, restricted mounts, and blocked network access. - Add policy checks that reject commands containing `--yolo` unless a separately authenticated exception is present. - Update the troubleshooting section to resolve permission failures by narrowing the task or granting specific capabilities rather than disabling all controls.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:56
• Finding: Untrusted Task Text Is Interpolated into Shell Command Strings## Vulnerability Details **File Location**: `SKILL.md:39, 44, 47, 56, 59, 66, 75-76, 195-196, 251`; `references/claude-code-commands.md:7-13, 42`; `references/codex-commands.md:7, 10, 13, 21` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code `SKILL.md:56-59` ```bash exec pty:true workdir:/path/to/project command:"codex exec --full-auto 'add error handling to API calls'" exec workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'add error handling to API calls'" ``` `SKILL.md:75-76` ```bash exec pty:true workdir:/path/to/project background:true command:"codex exec 'fix issue #78'" exec pty:true workdir:/path/to/project background:true command:"codex exec 'fix issue #99'" ``` `references/claude-code-commands.md:42` ```bash exec workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'refactor the user authentication module according to SOLID principles'" ``` The English task strings above are direct translations of the task text in the source. The vulnerable shell construction and quoting are unchanged. ### Technical Analysis The templates construct a single shell command and place task text inside shell quotes. If an implementation substitutes user-controlled task text directly into these templates, a matching quote can terminate the intended argument. Shell metacharacters can then append a new command. For example, task text structurally equivalent to the following can escape a single-quoted prompt: ```text benign text'; attacker_command; # ``` After unsafe substitution, the shell can interpret the resulting value as the intended agent command followed by `attacker_command`. Quoting a variable in an example is not sufficient when the quoted content itself is assembled through string concatenation. The risk is amplified when the target agent is also launched with permission bypass or unrestricted exec ...[truncated 1053 chars]
• Remediation: ## Remediation Suggestions - Invoke executables through a structured argument array rather than a shell command string. Pass the prompt as one discrete argument. - Disable shell interpretation when launching Codex, Claude Code, OpenCode, or Pi. - If the execution API cannot accept an argument array, apply rigorously tested, platform-specific escaping to every untrusted value. - Do not use ad hoc replacement of quote characters as a security control. - Reject NUL bytes and unexpected control characters, and enforce reasonable prompt-length limits. - Keep command names and options constant; only the prompt argument should be variable. - Add tests using single quotes, double quotes, semicolons, command substitutions, newlines, redirection operators, and platform-specific metacharacters. - Combine safe argument handling with sandboxing and least privilege so a parsing failure does not provide unrestricted host access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- GET /todos - 获取所有待办
- POST /todos - 创建待办
- PUT /todos/:id - 更新待办
- DELETE /todos/:id - 删除待办

要求：
1. 使用 Express.js

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

exec workdir:/tmp/issue-78 command:"git push -u origin fix/issue-78 && gh pr create --title 'fix: ...' --body '...'"

# 5. 清理
exec command:"git worktree remove /tmp/issue-78"
```

## 📊 进度更新规则

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# 一次性执行（推荐）
claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

claude --permission-mode bypassPermissions --print "你的提示词"

# 后台执行
claude --permission-mode bypassPermissions --print "你的提示词" &

# 指定工作目录
cd /path/to/project && claude --permission-mode bypassPermissions --print "你的提示词"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# 一次性执行
codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex exec "你的提示词"

# 自动批准模式
codex exec --full-auto "你的提示词"

# 无限制模式（危险）
codex exec --yolo "你的提示词"

• Confidence: 90% confidence
• Finding: `codex exec --full-auto` invokes an external coding agent in automatic approval mode, reducing human oversight over actions the model may take. In the context of a general-purpose coding-agent skill, this is more dangerous because users may apply it to real repositories or environments where unintended edits, command execution, or disclosure can occur quickly.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex exec --full-auto "你的提示词"

# 无限制模式（危险）
codex exec --yolo "你的提示词"
```

## 代码审查

• Confidence: 95% confidence
• Finding: `codex exec --yolo` is explicitly labeled dangerous and represents unrestricted execution with minimal safeguards. Within a coding-agent skill, exposing this as a routine command materially increases the risk of destructive changes, unsafe shell actions, or leakage of sensitive code and environment data if an agent follows the example.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

codex review --base main

# 审查特定提交
codex exec "审查 commit abc123 的变更"
```

## 配置

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

## 配置

配置文件位置：`~/.codex/config.toml`

```toml
[model]

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This markdown skill forces a specific language/locale in its user-facing description and operational guidance, with no indication that users may choose another language. Under the stated policy, a fixed language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly recommends running Claude Code with `--permission-mode bypassPermissions`, which disables an important safety control and allows the delegated coding agent to act without normal approval gates. In a general-purpose coding skill, this materially increases the chance of unintended code changes, secret exposure, or destructive actions if prompts, repositories, or downstream agent behavior are unsafe.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The guidance says sensitive projects should use `--full-auto` rather than `--yolo`, but `--full-auto` still auto-approves workspace changes and is not an appropriate default for sensitive repositories. This framing may cause users to overtrust an autonomous mode in high-value environments where manual review and tighter controls are needed.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The user-facing description and default prompt are written entirely in Chinese, which imposes a specific language on users without any opt-in or explanation that this skill is intended only for a Chinese-speaking context. The policy explicitly flags language or locale constraints when they are forced rather than optional or justified.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guidance explicitly recommends bypassing Claude Code permission checks and presents that mode as normal usage without any warning, constraints, or compensating controls. In a coding-agent skill, this is dangerous because the agent may execute filesystem or shell-affecting actions with reduced safeguards, increasing the chance of destructive changes, data exposure, or misuse if prompts or surrounding context are adversarial.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document advises users to use `--full-auto` or `--yolo` to bypass interactive confirmations, including in a troubleshooting section, without adequately explaining the operational risks. In a coding-agent skill, this increases the chance that an agent will execute destructive or privacy-impacting actions without human review, making unsafe automation more likely.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The natural-language content consistently assumes Chinese as the required language, and there is no indication that users may choose another language. Under the language/locale policy check, forcing a specific language without user opt-in is a policy concern unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file presents all instructional content in Chinese and does not indicate that the language choice is optional, user-selected, or required for a specific regional/compliance reason. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. The content appears to force a specific language without indicating user opt-in, alternatives, or a justified region-specific scope.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The template instructs the agent/user to run a local shell command (`openclaw system event --text ... --mode now`) after task completion without any warning, consent gate, or clarification that this triggers a host-side command. In a coding-agent skill, this is more concerning because prompt templates may be reused broadly and can normalize automatic command execution, creating a pathway for unsafe local actions if task summaries or surrounding instructions become attacker-influenced.

Static analysis

No suspicious patterns detected.