Claude Code 的 --dangerously-skip-permissions 等 YOLO 旗標在 CI 中如何帶來密鑰外洩風險
--dangerously-skip-permissions in CI: when AI agent YOLO flags leak your secrets
在 CI 中，若 AI 智能體以 YOLO 旗標跳過權限確認、處理未受信任的 issue 文字，並同時可存取密鑰、具寫入權限的 GITHUB_TOKEN 及開放網絡，就會構成憑證外洩風險。
An issue opens, a workflow starts, and an AI agent reads it:
run: |
claude -p "Fix this issue: ${{ github.event.issue.title }} ${{ github.event.issue.body }}" \
--dangerously-skip-permissions
The job also has ANTHROPIC_API_KEY, a write GITHUB_TOKEN and open network. Anyone who can open an issue now writes part of the prompt for an agent that never asks before running a command. (A made-up workflow, but a very common shape.)
Every agent CLI has a YOLO switch
- Claude Code:
--dangerously-skip-permissions=--permission-mode bypassPermissions. Its docs say to use it only in isolated containers or VMs without internet access, and that it "offers no protection against prompt injection". - Codex CLI:
--yolo(--dangerously-bypass-approvals-and-sandbox) and--sandbox danger-full-access. - Gemini CLI:
--approval-mode=yolo(old--yolo/-y). - Also Cursor CLI
--force, Copilot CLI--allow-all-tools, Qwen Code--yolo, Kiro CLI--trust-all-tools, OpenCode--auto.
The flag is not the problem. The flag plus a place with secrets, a write token, untrusted text, your home directory or a devcontainer that mounts ~/.ssh is.
The fix in one list
- Use scoped modes:
--permission-mode acceptEditsordontAskwith--allowedTools,--sandbox workspace-write,--approval-mode=auto_edit. - Pass issue and PR text through an env var or file, never inline in the prompt.
- Give the job the smallest token it needs, and keep real YOLO runs in a clean container.
Checked in VS Code
I built YoloGuard, a free VS Code extension that finds these flags in workflows, npm scripts, Makefiles, shell scripts, tasks, Dockerfiles, compose files and devcontainers, and rates each one by where it runs. Seven rules, from "inside a container" (information) to "untrusted issue text in a bypass agent's prompt" (error), with Quick Fixes to scoped modes and an activity bar panel. On the workflow above it reports:
YG007 Claude Code runs with --dangerously-skip-permissions, which turns off every permission
prompt and safety check, and its prompt includes the issue title, issue body, which anyone who
can open an issue or PR controls.
No network, no telemetry, no child processes.
code --install-extension jaytankdev.yologuard
Source (MIT): github.com/jay-tank/yologuard
Full write-up (what each flag turns off, why location decides the risk, the fixed workflow, FAQ): --dangerously-skip-permissions in CI
來源：DEV Community · dev.to