--dangerously-skip-permissions in CI: when AI agent YOLO flags leak your secrets

An issue opens, a workflow starts, and an AI agent reads it:

run: |
  claude -p "Fix this issue: ${{ github.event.issue.title }} ${{ github.event.issue.body }}" \
    --dangerously-skip-permissions

The job also has ANTHROPIC_API_KEY, a write GITHUB_TOKEN and open network. Anyone who can open an issue now writes part of the prompt for an agent that never asks before running a command. (A made-up workflow, but a very common shape.)

Every agent CLI has a YOLO switch

• Claude Code: --dangerously-skip-permissions = --permission-mode bypassPermissions. Its docs say to use it only in isolated containers or VMs without internet access, and that it "offers no protection against prompt injection".
• Codex CLI: --yolo (--dangerously-bypass-approvals-and-sandbox) and --sandbox danger-full-access.
• Gemini CLI: --approval-mode=yolo (old --yolo / -y).
• Also Cursor CLI --force, Copilot CLI --allow-all-tools, Qwen Code --yolo, Kiro CLI --trust-all-tools, OpenCode --auto.

The flag is not the problem. The flag plus a place with secrets, a write token, untrusted text, your home directory or a devcontainer that mounts ~/.ssh is.

The fix in one list

• Use scoped modes: --permission-mode acceptEdits or dontAsk with --allowedTools, --sandbox workspace-write, --approval-mode=auto_edit.
• Pass issue and PR text through an env var or file, never inline in the prompt.
• Give the job the smallest token it needs, and keep real YOLO runs in a clean container.

Checked in VS Code

I built YoloGuard, a free VS Code extension that finds these flags in workflows, npm scripts, Makefiles, shell scripts, tasks, Dockerfiles, compose files and devcontainers, and rates each one by where it runs. Seven rules, from "inside a container" (information) to "untrusted issue text in a bypass agent's prompt" (error), with Quick Fixes to scoped modes and an activity bar panel. On the workflow above it reports:

YG007 Claude Code runs with --dangerously-skip-permissions, which turns off every permission
prompt and safety check, and its prompt includes the issue title, issue body, which anyone who
can open an issue or PR controls.

No network, no telemetry, no child processes.

code --install-extension jaytankdev.yologuard

Source (MIT): github.com/jay-tank/yologuard

Full write-up (what each flag turns off, why location decides the risk, the fixed workflow, FAQ): --dangerously-skip-permissions in CI