Security audit
Security checks for vulnerabilities and agentic risk
This guide is not malware, but it gives agents broad automatic coding powers and persistent credential/config access, so users should review it before installing.
Install only if you intend to delegate coding work to Codex CLI. Prefer read-only or approval-required modes first, avoid --full-auto and --yolo except in isolated trusted workspaces, review any changes to ~/.codex or Clawdbot auth/config files, and pin or vet any third-party MCP servers before enabling them.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
codex login
# Or use API key
printenv OPENAI_API_KEY | codex login --with-api-key
# Verify auth
codex login status
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec "fix the CI failure" # Run and exit
codex exec --full-auto "add input validation" # Auto-approve workspace writes
codex exec --json "list all API endpoints" # JSON output for parsing
codex exec -i screenshot.png "match this design" # With image input
This example combines external provider use with --full-auto, meaning repository content may be sent to an outside model while autonomous changes are made locally. The combination raises the security impact beyond ordinary model selection because it couples off-box processing with unattended execution.
codex exec "fix the CI failure" # Run and exit
codex exec --full-auto "add input validation" # Auto-approve workspace writes
codex exec --json "list all API endpoints" # JSON output for parsing
codex exec -i screenshot.png "match this design" # With image input
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec "fix the CI failure" # Run and exit
codex exec --full-auto "add input validation" # Auto-approve workspace writes
codex exec --json "list all API endpoints" # JSON output for parsing
codex exec -i screenshot.png "match this design" # With image input
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec "fix the CI failure" # Run and exit codex exec --full-auto "add input validation" # Auto-approve workspace writes codex exec --json "list all API endpoints" # JSON output for parsing codex exec -i screenshot.png "match this design" # With image input
### Session Management
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
/review # Choose: branch, uncommitted, or specific commit
codex exec "review the changes in this PR against main branch"
## Multi-Directory Projects
Referencing ~/.codex/config.toml instructs users to modify an agent configuration file in a home directory, which is a sensitive, persistent control surface. In agent ecosystems, writing or influencing config files can silently change future behavior, including enabling networked features or broader permissions across sessions.
Enable in ~/.codex/config.toml:
[features]
This workflow example recommends using an external coding model with --full-auto to fix CI automatically, coupling third-party processing with unattended code changes. In practice this can result in broad repository modifications without review and may expose code or logs externally.
codex exec --full-auto "The CI is failing on the lint step. Fix all ESLint errors."
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec --cd src/components "Refactor UserProfile.tsx to use React Query instead of useEffect for data fetching"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec -i spec.png --cd ~/projects/app "Implement this feature based on the design spec"
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
codex exec "Review the diff between main and feature/auth branch. Focus on security issues."
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
| `/feedback` | Send logs to maintainers |
| `/init` | Generate AGENTS.md |
| `/logout` | Sign out |
| `/mcp` | List MCP tools |
| `/mention <path>` | Attach file |
| `/model` | Switch model |
| `/new` | Fresh conversation |
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Location: ~/.codex/config.toml
[model]
The trigger list includes broad phrases like codex, code review, implement feature, and coding agent, which can match many ordinary requests and cause unintended invocation of a high-privilege coding skill. Because this skill can execute commands and edit files, accidental activation materially increases the chance of unauthorized or surprising actions.
The documentation normalizes codex exec --full-auto and auto-approved workspace writes without a strong warning that the tool may make autonomous code and command changes. In a delegated-agent context, users may not appreciate that this bypasses human review and can modify repositories at scale.
--full-auto explicitly enables autonomous decision-making for workspace writes and failure approval, reducing human oversight over code changes and executed actions. In a skill meant for delegation, this increases the risk of unsafe edits, broken builds, or malicious prompt-triggered behavior being applied automatically.
codex exec "fix the CI failure" # Run and exit
codex exec --full-auto "add input validation" # Auto-approve workspace writes
codex exec --json "list all API endpoints" # JSON output for parsing
codex exec -i screenshot.png "match this design" # With image input
The skill describes Full Access as allowing full machine and network access, but does not pair that capability with a strong warning about data exposure, credential access, destructive commands, or exfiltration risk. In this context, a coding agent with filesystem and network access is highly sensitive and misuse could impact the entire host environment.
The skill encourages storing reusable prompts in ~/.codex/prompts/, which creates persistent behavior across sessions and repositories. Persistent prompt artifacts can silently influence future agent actions, leak assumptions between projects, or become a persistence mechanism if tampered with.
Create reusable prompts in ~/.codex/prompts/:
<!-- ~/.codex/prompts/pr.md -->
The skill recommends launching an MCP server via npx @anthropic/mcp-server-github without pinning an exact version. This can pull a newer or compromised package at runtime, expanding supply-chain risk in a tool that already has powerful local execution and integration capabilities.
This guidance explicitly recommends codex exec --full-auto against a local project, which enables autonomous code modification without any required confirmation, review gate, or warning about side effects. In the context of an agent integration skill, this is dangerous because downstream agents may operationalize the example as a default behavior and make unintended or unsafe repository changes, especially when prompts or repo contents are adversarial.
The sample AGENTS.md instruction tells the agent to use Codex CLI for coding tasks with codex exec --full-auto and then report results, but it does not require consent, scope restriction, or verification before execution. Because AGENTS.md often acts as behavioral policy for agents, this can normalize autonomous code execution as a standing instruction and increase the chance of unsafe edits, destructive changes, or prompt-influenced misuse.
The combination of --ask-for-approval ... never and especially --yolo describes autonomous operation with no approval gate and no sandbox restrictions. In the context of a skill specifically meant to delegate coding work to Codex CLI, this makes unsafe autonomous filesystem, process, and network actions substantially more dangerous because the skill encourages agent-driven execution.
| `--sandbox, -s` | read-only, workspace-write, danger-full-access | Sandbox policy |
| `--ask-for-approval, -a` | untrusted, on-failure, on-request, never | Approval mode |
| `--full-auto` | boolean | workspace-write + approve on failure |
| `--yolo` | boolean | No approvals or sandbox (dangerous) |
| `--profile, -p` | string | Config profile name |
| `--oss` | boolean | Use local Ollama |
| `--search` | boolean | Enable web search |
The reference explicitly documents a --yolo mode that disables both approvals and sandboxing, but only labels it as 'dangerous' without explaining the consequences. In a coding-agent skill, this materially increases the chance that users or downstream agents invoke unrestricted code execution without understanding the risk to the local system, files, or network.
The /feedback command says it sends logs to maintainers, but the reference does not warn that logs may contain prompts, filenames, code snippets, environment details, or other sensitive metadata. Users of a coding agent may unknowingly transmit confidential project information externally.
No suspicious patterns detected.