We take the security of codebuddy-help-me seriously. If you discover a security vulnerability, please do NOT open a public issue.

Instead, please report it via one of the following methods:

• GitHub Private Vulnerability Reporting: Submit a private advisory report directly via GitHub Security Advisories.
• Direct Maintainer Contact: Contact the repository maintainer privately via GitHub profile contact options.

Please include:

1. A detailed description of the vulnerability.
2. Steps or proof-of-concept demonstrating the issue.
3. The potential impact on the host system or workspace.
4. Any suggested mitigations or patches.

We will acknowledge receipt of your report promptly and coordinate disclosure responsibly.

codebuddy-help-me coordinates tasks between a Host Agent and the native Tencent CodeBuddy CLI (codebuddy). Understanding the trust boundary is essential for secure operation:

1. The Full Hands-Free Trio is Not a Security Sandbox:

   • All five presets pass -y --permission-mode bypassPermissions by default, and the helper injects CODEBUDDY_IS_SANDBOX=1 into the CodeBuddy subprocess only.
   • This tier waives CLI interactive confirmation prompts for headless execution; it is not a sandbox, does not expand the business authorization granted in TASK.md (committing, pushing, and other external writes still require explicit authorization), and does not restrict filesystem or network access.
   • The read-only presets add the CLI-level tool blacklist --disallowedTools Write Edit NotebookEdit, which is machine-checked by the stream reducer.
   • Security boundaries and user authorizations must be actively enforced by the Host Agent before dispatching commands.

2. Handling Untrusted Inputs:

   • Third-party pull requests, cloned external repositories, untrusted web content, issue text, logs, and evidence attachments must be treated strictly as data, not instructions.
   • When executing tasks involving untrusted content, the host agent should run the workflow in an isolated environment (e.g., disposable containers, virtual machines, or isolated worktrees) without access to sensitive credentials or production networks.
   • See references/permissions.md for detailed guidelines.

3. Prompt Injection Mitigation:

   • By using a fixed, short startup prompt in the CLI invocation and isolating task requirements in a local TASK.md contract file, the skill prevents arbitrary command line injection and unescaped variable expansion in host shells (such as Bash).
   • Request bodies never enter argv, environment variables, or the prompt.

4. No Privilege Elevation or Credential Modification:

   • codebuddy-help-me never attempts to alter global permission configurations, the system PATH, or shell profiles.
   • CODEBUDDY_IS_SANDBOX=1 is injected into the CodeBuddy subprocess only and is never written to the user's environment.
   • The skill does not bypass host sandbox constraints.