CS Relogin

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:55 AM UTC
• Version: 1.1.2

Overview

The skill is for a legitimate account-switching task, but it handles sensitive OAuth input through an unsafe shell-style command pattern and can expose raw authentication errors.

Review this skill carefully before installing. Its goal is understandable, but only use it when you intentionally want to switch the local Codex account, and avoid pasting callback text from untrusted sources. A safer version should require explicit user confirmation for callback completion, pass callback data as a structured argument rather than shell text, validate accepted callback formats, and redact authentication errors before showing them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:28

Finding

Shell Command Injection Through User-Controlled OAuth Callback Input

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-32
Vulnerability Type: Command injection through unsafe shell interpolation
Risk Level: High

Vulnerable Code

markdown

2. If user input contains callback URL/code:
   - Run:
     ```bash
     cs relogin "<callback-url-or-code>"
     ```

Technical Analysis

The skill instructs the agent to place a callback URL or authorization code supplied by the user directly into a Bash command. Quoting the value with double quotes does not reliably prevent shell injection. Bash continues to evaluate command substitutions such as $() and backticks inside double-quoted strings.

If the agent constructs the documented command as shell text without structured argument passing or shell-safe encoding, a crafted callback value can cause an additional command to execute before cs relogin receives its argument. The skill does not require callback format validation, character allowlisting, shell escaping, or use of a process API that accepts an argument array.

Attack Path

1. An attacker supplies a callback value containing shell syntax, such as a command substitution expression.
2. The agent substitutes the value into the documented cs relogin "..." command.
3. Bash evaluates the injected command substitution while processing the double-quoted argument.
4. The injected command executes under the operating-system identity and permissions of the agent process.
5. The resulting output is passed to cs relogin, potentially obscuring the preceding unauthorized execution.

Impact Assessment

Successful exploitation can provide arbitrary command execution with the agent's local privileges. Depending on those privileges and the surrounding environment, an attacker could read accessible files and credentials, modify project or user files, execute local programs, make network requests, or interfere with authentication state. The issue does n ...[truncated 143 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by interpolating the callback value into command text.
• Invoke cs through a structured process-execution interface using a fixed argument array, equivalent to ["cs", "relogin", callback], with shell processing disabled.
• Validate callback input against the exact formats supported by cs, including an allowlisted URL scheme, expected callback host and path, permitted query parameters, and documented authorization-code character set and length.
• Reject control characters, unexpected URL schemes, malformed encoding, and input containing data outside the documented callback grammar.
• If a shell is unavoidable, use a well-tested shell-escaping routine and pass the value as a positional parameter rather than concatenating it into executable command text.
• Add security tests covering $(), backticks, quotes, semicolons, newlines, redirection operators, and other shell metacharacters.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50

Finding

Potential Authentication Secret Disclosure Through Unfiltered Standard Error

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-51
Vulnerability Type: Sensitive information exposure through raw error output
Risk Level: Medium

Vulnerable Code

markdown

- Never expose full tokens/secrets.
- On command failure, include raw cs stderr first (do not guess the reason).

Technical Analysis

The instruction to reproduce raw cs standard error conflicts with the requirement not to expose tokens or secrets. Authentication-related error output may contain submitted callback data, authorization codes, account identifiers, local filesystem paths, request details, or other sensitive diagnostic information.

Because the instruction explicitly requires raw output, the agent is not directed to inspect or redact sensitive values before placing the error in the conversation. Even if cs normally avoids printing secrets, the skill establishes an unsafe failure-handling policy that could expose information when behavior changes, unusual input triggers verbose diagnostics, or an upstream component includes sensitive context in an error.

Attack Path

1. A login or callback-completion operation fails, whether naturally or because malformed input is supplied.
2. cs or a component it invokes writes diagnostic information to standard error.
3. The diagnostic output includes callback parameters, authorization material, account information, or sensitive local-environment details.
4. Following the skill instruction, the agent copies the raw standard error into its response.
5. The sensitive information becomes available in conversation history, logs, or downstream systems that process agent responses.

Impact Assessment

The primary impact is loss of confidentiality. Exposed authorization codes or tokens may enable account access if they remain valid and are not bound to protections that prevent reuse. Account identifiers and diagnostic metadata can support targeted attacks, while ...[truncated 151 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the requirement to return raw standard error with a requirement to provide sanitized diagnostic output.
• Redact access tokens, refresh tokens, authorization codes, cookies, callback query values, email addresses, account identifiers, and sensitive filesystem paths before displaying errors.
• Prefer stable error codes and concise summaries over verbatim authentication-tool output.
• Preserve full diagnostics only in an appropriately protected local log with restrictive permissions and defined retention.
• Apply conservative pattern-based redaction and URL parsing so sensitive query parameters are removed even when output formatting changes.
• If safe redaction cannot be guaranteed, report only that the command failed, the exit status, and a non-sensitive recovery action such as checking relogin status.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description authorizes activation on broad natural-language requests like 're-login' or 'switch ChatGPT Codex account,' not just the exact cs relogin command. That can cause the skill to trigger on ordinary conversation and handle sensitive OAuth callback URLs or initiate account-switching actions when the user did not clearly intend to invoke this specific local command flow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction requires an explicit acknowledgement and labels it with the Chinese term '回执' in a MUST rule, but the skill does not indicate that language choice is optional or region-specific. This can be read as imposing a locale-specific convention without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.