coding-agent

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document explicitly instructs bypassing agent sandboxes/approvals (e.g. --yolo, --permission-mode bypassPermissions), running agents with host/elevated access and background sessions that can execute arbitrary shell commands, commit/push code, and trigger system events — behaviors that enable data exfiltration, unauthorized remote code execution, and supply‑chain tampering.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow explicitly instructs cloning and reviewing public GitHub repos (e.g., "git clone https://github.com/user/repo.git $REVIEW_DIR" and the "Reviewing PRs" / "Batch PR Reviews" sections) and then running coding agents (codex review / exec) that read and act on that untrusted, user-generated code, so third-party content can influence tool decisions and actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs using flags that bypass permissions and sandboxes (e.g., --permission-mode bypassPermissions, --yolo "NO sandbox, NO approvals", and an "elevated" option), which directs agents to circumvent security controls and run with potentially unsafe host-level privileges, so it pushes the agent to compromise machine state.