coding-agent

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly requires capturing notification route fields (notifyChannel, notifyTarget, notifyAccount, etc.) and injecting them verbatim into worker prompts and shell commands (e.g., openclaw message send), forcing the model to output those route identifiers directly which can be sensitive.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly instructs disabling sandboxing and approval checks (e.g., --yolo, --permission-mode bypassPermissions, --full-auto), running agents on the host, and forcing direct outbound completion messages (openclaw message send) which together enable remote code execution, stealthy autonomous commits/pushes, and easy exfiltration of repository or host data — a high-risk, intentionally dangerous operational pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill runs git clone at runtime to fetch repository contents that are then provided to the coding agent (codex) for review, e.g. "https://github.com/user/repo.git", so remote code/content directly influences the agent's prompts and behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill repeatedly instructs using flags and parameters that bypass sandboxing and permission checks (e.g., --permission-mode bypassPermissions, --yolo, and an "elevated" host flag), which encourages running agents with host-level or unrestricted privileges and therefore can compromise the machine state.