--dangerously-skip-permissions in CI: when AI agent YOLO flags leak your secrets

An issue was opened, a workflow began, and an AI agent read through the details: run the command {{ github.event.issue.title }} ${{ github.event.issue.body }} --dangerously-skip-permissions. This job also had ANTHROPIC_API_KEY, a write GITHUB_TOKEN, and an open network.

The danger lies in the misuse of the --dangerously-skip-permissions flag when running AI agents within workflows, especially when sensitive secrets, write tokens, untrusted text, home directories, or devcontainers that mount ~/.ssh are present. The flag itself does not pose a risk; it's the combination of this flag with the presence of secrets, untrusted text, and vulnerable environments that creates a security issue.

To mitigate this risk, it's recommended to use scoped modes such as --permission-mode acceptEdits or dontAsk with --allowedTools, --sandbox workspace-write, and --approval-mode=auto_edit. Another solution is to pass issue and PR text through an environment variable or file, instead of embedding it directly in the prompt. Additionally, limiting the token permissions to the smallest necessary scope and keeping the actual YOLO runs in a clean container can help maintain security.

The author has developed a free VS Code extension called YoloGuard, which scans workflows, npm scripts, Makefiles, shell scripts, tasks, Dockerfiles, compose files, and devcontainers for these dangerous flags. The extension provides risk ratings and Quick Fixes, including guidance on scoped modes and an activity bar panel to help identify potential issues.