YoloGuard: AI Agent Permission-Bypass Flag Checker

Every AI coding agent has a flag that turns its safety checks off: claude --dangerously-skip-permissions, codex --yolo, gemini --approval-mode=yolo, cursor-agent --force, copilot --allow-all-tools. On a throwaway VM with no secrets that is fine. The trouble is where these flags end up once a demo turns into a workflow:

on:
  issues:
    types: [opened]
permissions:
  contents: write
jobs:
  triage:
    runs-on: ubuntu-latest
    env:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - run: claude -p "Triage this: ${{ github.event.issue.body }}" --dangerously-skip-permissions

Anyone who can open an issue now writes the prompt for an agent that runs any command it likes, with your API key in its environment and a token that can push to the repository. The same flag in a postinstall script, a Makefile target or a dev container that mounts ~/.ssh runs with the credentials of whoever types npm install.

YoloGuard finds every launch of an AI agent CLI with a bypass flag in your workflows, scripts and config files, and rates it by where it runs: a CI job with secrets, a write token or issue/PR triggers, an untrusted prompt, your own machine, a container that mounts host credentials, or a real sandbox.

What you see

• Problems and squiggles on the exact flag, with a message that says what the flag turns off, what the context exposes (secrets, permissions, triggers, mounts) and the scoped mode to use.
• Quick Fixes (lightbulb) where the tool documents a scoped mode: --permission-mode acceptEdits or --permission-mode dontAsk for Claude Code, --sandbox workspace-write for Codex, --approval-mode=auto_edit for Gemini CLI, --approval-mode auto-edit for Qwen Code, --allow-tool=write for Copilot CLI. In argument lists (tasks.json args, compose lists, Dockerfile exec form) the fix uses the single-argument --flag=value form. YoloGuard never removes or edits secrets.
• Activity bar: a YoloGuard icon opens the Agent bypass flags view. Findings are grouped by file and each row names the exact place, for example ci.yml job triage: claude --dangerously-skip-permissions with ANTHROPIC_API_KEY + contents: write on issues or devcontainer.json postCreateCommand: claude --dangerously-skip-permissions with ~/.ssh mounted. Click a row to jump to the flag, or use the inline lightbulb button to apply its Quick Fix. A badge on the icon shows the number of findings.
• Status bar: YoloGuard: N. Click it to open the view.

Open files are checked as you type. The rest of the workspace is scanned in the background.

Rules

Each rule's severity can be changed or turned off. Aider findings are one step lower than the table, because --yes-always still asks before running shell commands.

Agents and flags

Every flag was checked against the tool's official documentation on 2026-10-24.

How commands are read

Commands are parsed like a shell would: quotes, escapes, \ line continuations, &&, ||, ;, pipes, subshells, if / for bodies, comments and heredoc data. Wrappers are followed: FOO=1 prefixes, env, sudo, timeout, nohup, npx / bunx / pnpm dlx / yarn dlx / npm exec with the agent's npm package, uvx / pipx run / uv tool run, sh -c / bash -lc strings, doppler run -- style secret injectors, and docker run / podman run / docker compose run / devcontainer exec (whose mounts decide between YG004 and YG005). Flags kept in a variable (FLAGS=--yolo, Makefile $(AGENT_FLAGS), ${{ env.FLAGS }}) are expanded. Arguments after a bare -- and text passed to echo or grep are never treated as flags.

Files checked

GitHub Actions workflows (.github/workflows/*.yml), composite action.yml, *.sh / *.bash / *.zsh, Makefile / *.mk, package.json scripts, .vscode/tasks.json, Dockerfile / Containerfile, compose.yml / docker-compose*.yml, devcontainer.json, Taskfile.yml, lefthook.yml, .husky/* and .githooks/* hooks, and .claude/settings.json.

To accept a launch you have reviewed (for example inside a disposable VM), put yologuard-ignore in a comment on the same line or the line above.

Settings

In an untrusted (Restricted Mode) workspace YoloGuard still runs, but it reads every one of its settings from your user settings only, so a repository can not switch it off, silence a rule, exclude its own files or declare new agent commands.

Commands

• YoloGuard: Show Agent Bypass Flags - open the view.
• YoloGuard: Rescan Workspace - scan again (also a button in the view title).
• YoloGuard: Open Settings

Privacy

No network, no telemetry. YoloGuard reads files inside your workspace, never follows symlinks out of it, runs no child processes and changes files only when you apply a Quick Fix.

Limitations

• CI context is understood for GitHub Actions. Other CI systems are not read; their shell scripts are checked when they live in .sh files.
• Secrets are recognised from ${{ secrets.* }} and github.token expressions in the workflow, job and step env, the command itself and agent action inputs. Secrets written to $GITHUB_ENV in an earlier step, or exposed only through a checked-out token in .git/config, are not traced.
• Untrusted text is followed into the agent's arguments, pipes, heredocs and variables in the same step. Text written to a file in one step and read by the agent in another is not traced.
• Scripts are not followed across files: a workflow that runs ./scripts/agent.sh is reported in agent.sh (as YG003), not in the workflow.
• Docker Compose based dev containers: mounts declared in the compose file are not linked to the dev container's lifecycle commands.
• Agent flags change often. Flags added to a CLI after this release are not known yet.

References

• Claude Code permission modes
• Codex CLI command reference
• Security hardening for GitHub Actions

License

MIT - included with the extension.