coding-strategy

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly instructs automated, unsandboxed/full-auto code execution (e.g., Codex "--yolo" and "full-auto" with pty shell execution), shows how to retrieve stored API keys (op://DeLoSecrets/...), and describes persistent hooks/self-learning (.claude-flow/) and multi-agent orchestration that together enable unauthorized remote code execution, secret access/exfiltration, and automated supply-chain/backdoor insertions—strong indicators of high abuse potential.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md "Review Army (batch PR reviews)" workflow explicitly fetches pull request refs from origin (git fetch origin '+refs/pull//head:refs/remotes/origin/pr/') and runs codex exec to review PRs, which means the agent will ingest and act on user-generated, potentially public GitHub PR content that could contain adversarial instructions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs running external coding agents and shell commands (e.g., codex exec --yolo "no sandbox, no approvals"), spawning background processes that execute code, and accessing secrets (op://...) — explicitly suggesting bypassing sandboxing/approvals and enabling arbitrary code execution on the host, so it poses a high risk of compromising machine state.