Codex All-in-One for ArkClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.2

Overview

This skill is meant to configure Codex, but it needs Review because it persistently changes shell and Codex settings, stores API keys, and contains unsafe command-injection paths.

Install only after reviewing that it will modify your shell startup file and live Codex configuration, store provider keys in plaintext, and route future Codex traffic through selected or custom providers. Use disposable or tightly scoped API keys, avoid untrusted custom endpoints, and prefer an isolated sandbox until the shell-escaping and eval issues are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup-thirdparty.sh:85

Finding

Persistent Shell Command Injection Through Third-Party API Key

Content

View full analysis

/dev/null || true echo "export $ENV_KEY_NAME=\"$KEY\"" >> "$HOME/.bashrc" export "$ENV_KEY_NAME=$KEY" ``` ### Technical Analysis The `KEY` parameter is controlled by the caller and is interpolated directly into a shell command written to `~/.bashrc`. The script does not apply shell escaping or the key-format validation used by the AgentPlan setup scripts. A value containing double quotes, command substitutions, shell metacharacters, or embedded newlines can terminate the intended assignment and append arbitrary commands. Because the resulting content is placed in `.bashrc`, the injected command executes whenever a future interactive Bash shell sources that file. Although the immediate `export "$ENV_KEY_NAME=$KEY"` command safely treats the value as one argument, that does not protect the separately generated `.bashrc` statement. ### Attack Path 1. An attacker persuades a user or agent to configure a third-party provider with a crafted API key. 2. The Skill invokes `setup-thirdparty.sh` with the crafted value. 3. The script writes the unescaped value into `~/.bashrc`. 4. The payload breaks out of the quoted environment assignment and adds a shell command. 5. The command executes when the user opens a new Bash session or manually runs `source ~/.bashrc`. 6. Since the modification is persistent, the payload may execute repeatedly across sessions. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the Skill. An attacker could read or modify user files, steal other API credentials, alter development tools, install additional persistence, or redirect future model traffic. The scope is the affected user account and all data and se ...[truncated 38 chars]

Remediation

View remediation

> "$HOME/.bashrc" ``` - Validate `ENV_KEY_NAME` independently using: ```bash [[ "$ENV_KEY_NAME" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || exit 1 ``` - Reject credentials containing control characters or line breaks. - Write changes atomically through a securely created temporary file. - Add regression tests using credentials containing quotes, newlines, dollar signs, backticks, and command substitutions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/health-check.sh:60

Finding

Command Execution Through Unsafe Evaluation of Configuration-Controlled Environment Variable Name

Content

View full analysis

/dev/null || echo 'null')" fi ``` ### Technical Analysis `ENV_KEY` is parsed from the user-managed `~/.codex/config.toml` file and inserted into an `eval` expression without validation. `eval` reparses the constructed string as shell syntax, allowing command substitutions or other shell expressions embedded in a malicious `env_key` value to execute. The issue is particularly exposed because `doctor.sh` automatically invokes `health-check.sh` when it detects a user-managed Codex configuration. Merely triggering routine Skill diagnostics can therefore evaluate attacker-controlled configuration content. ### Attack Path 1. An attacker creates, modifies, or supplies a malicious `~/.codex/config.toml`. 2. The file contains a provider section ...[truncated 851 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-agentplan.sh:139

Finding

API Credentials Persisted in Plaintext Shell Startup Configuration

Content

View full analysis

/dev/null || true echo "export ARK_API_KEY=\"$KEY\"" >> "$HOME/.bashrc" export ARK_API_KEY="$KEY" ``` From `scripts/setup-codingplan.sh`: ```bash sed -i '/^export ARK_API_KEY=/d' "$HOME/.bashrc" 2>/dev/null || true echo "export ARK_API_KEY=\"$KEY\"" >> "$HOME/.bashrc" export ARK_API_KEY="$KEY" ``` From `scripts/setup-thirdparty.sh`: ```bash sed -i "/^export $ENV_KEY_NAME=/d" "$HOME/.bashrc" 2>/dev/null || true echo "export $ENV_KEY_NAME=\"$KEY\"" >> "$HOME/.bashrc" export "$ENV_KEY_NAME=$KEY" ``` ### Technical Analysis Provider credentials are written in plaintext to `~/.bashrc`, a general-purpose shell startup file. The scripts do not verify or enforce restrictive permissions on that file. Every interactive shell that loads `.bashrc` receives the credential in its environment. This design expands the credential exposure surface to child processes, diagnostic tools, shell backups, support bundles, accidental file sharing, and any local process able to inspect the user’s shell configuration or process environment. The troubleshooting documentation also encourages searching `.bashrc` for API key assignments, increasing the chance of accidental disclosure in copied terminal output. ### Attack Path 1. A user configures AgentPlan, Coding Plan, Kimi, DeepSeek, Ark v3, or a custom provider. 2. The setup script writes the corresponding API key directly into `~/.bashrc`. 3. The key remains available across future shell sessions. 4. A local process, backup mechanism, troubleshooting transcript, or party with read access to the file obtains the credential. 5. The exposed key is used against ...[truncated 441 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/relay-helper.sh:115

Finding

Server-Side Request Forgery and Credential Disclosure Through Unrestricted Custom Endpoint

Content

View full analysis

/dev/null || echo "000")" ``` From `scripts/setup-thirdparty.sh`: ```bash custom) # Automatically probe whether the upstream supports the Responses API log "正在探测 $CUSTOM_BASE_URL 是否原生支持 Responses API..." if probe_responses_support "$CUSTOM_BASE_URL" "$KEY"; then log " → 上游原生支持 Responses,直连无需 relay" USE_RELAY="no" EFFECTIVE_BASE_URL="$CUSTOM_BASE_URL" else log " → 上游仅支持 Chat,将通过本地 relay (端口 4449) 翻译" USE_RELAY="yes" RELAY_PORT="4449" RELAY_UPSTREAM="$CUSTOM_BASE_URL" EFFECTIVE_BASE_URL="http://127.0.0.1:${RELAY_PORT}/v1" # Persist upstream URL for .bashrc recovery echo "$CUSTOM_BASE_URL" > "$CODEX_DIR/custom-upstream" fi ;; ``` ### Technical Analysis The custom endpoint is supplied by the caller and is used directly as a `curl` destination. The implementation does not enforce HTTPS, validate the hostname, restrict ports, resolve and inspect destination addresses, or block loopback, private, link-local, Unix-socket-like, or cloud metadata targets. The probe also sends the supplied bearer credential to the chosen endpoint. If the destination is attacker-controlled, the credential is disclosed immediately. If the endpoint is classified as requiring the relay, it is persisted and may receive future model prompts and source code through the relay. This creates both a server-side request forgery primitive from the Skill’s execution environment and a route for credential and data di ...[truncated 1134 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-thirdparty.sh:143

Finding

Configuration Injection Through Unsafe TOML Template Substitution

Content

View full analysis

"$PROFILE_FILE" else cp "$TMPL" "$PROFILE_FILE" if [ -n "$CUSTOM_MODEL" ]; then sed -i "s|^model = \".*\"|model = \"$CUSTOM_MODEL\"|" "$PROFILE_FILE" fi fi ``` The target template contains quoted placeholders: ```toml model = "__MODEL__" model_provider = "custom" [model_providers.custom] name = "Custom Provider" base_url = "__BASE_URL__" ``` ### Technical Analysis `CUSTOM_MODEL` and `EFFECTIVE_BASE_URL` originate from caller-controlled input and are inserted into TOML using `sed`. The values are not escaped for either the `sed` replacement language or TOML string syntax. Characters such as double quotes, backslashes, ampersands, delimiter characters, and newlines can alter the generated configuration. A crafted model or URL can terminate the intended TOML string and add new fields or sections. It can also corrupt the `sed` expression and cause partial or unexpected output. The non-custom model override has the same fundamental issue because `CUSTOM_MODEL` is inserted directly into a quoted TOML assignment. ### Attack Path 1. An attacker supplies a crafted model name or custom base URL. 2. `setup-thirdparty.sh` interpolates the value into the `sed` replacement expression. 3. The crafted content escapes the intended TOML string or injects additional configuration lines. 4. The generated file is linked as the active Codex configuration. 5. Codex subsequently loads and applies the attacker-influenced settings. 6. Depending on the injected directives supported by Codex, traffic may be redirected or operational behavior may be modified. ### Impact Assessment At minimum, exploitation can cor ...[truncated 415 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:61

Finding

Unpinned Executable Dependencies Installed From Mutable Package Registry State

Content

View full analysis

/dev/null 2>&1 || { echo "❌ codex-relay 安装失败。请手动执行: pip install --user --break-system-packages codex-relay" >&2 return 1 } ``` ### Technical Analysis The Skill installs executable dependencies from npm and PyPI without pinning an exact reviewed version or verifying an integrity digest. `@openai/codex@latest` is explicitly mutable. The Python installation similarly resolves whichever `codex-relay` release is current at execution time. Consequently, the code that runs during and after installation can differ from the code reviewed during this audit. The use of `--break-system-packages` also weakens package-environment isolation and increases the chance of conflicts with system-managed Python components. ### Attack Path 1. A dependency account, package release process, registry path, or transitive dependency becomes compromised. 2. A malicious or incompatible version becomes the version resolved by `latest` or by the unversioned package name. 3. The user invokes the installation or setup path. 4. npm or pip downloads and installs the new package. 5. Installation hooks or the installed executable run with the privileges of the user invoking the Skill. 6. The compromised tool can access prompts, source code, credentials, and files available to that user. ### Impact Assessment A compromised dependency can execute arbitrary code as the affected user. Because Codex and the relay process handle source code, prompts, and API credentials, a supply-chain compromise could expose all of those assets. The affected scope includes the user account, the configured development env ...[truncated 79 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (94)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description promises an all-in-one skill that installs and configures Codex CLI for multiple provider backends and endpoint scenarios. However, the supplied code only performs local installation/upgrade of the Codex CLI package and PATH setup. The script explicitly states it does not configure any key or provider settings. This is a material description-behavior mismatch: the actual code covers installation only, not the broader configuration and provider-switching capabilities claimed in the description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

│ 运行 scripts/doctor.sh │ ← 每次触发都会运行,检测当前环境状态

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

│ 运行 scripts/doctor.sh │ ← 每次触发都会运行,检测当前环境状态

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

`scripts/install.sh` 的行为:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

| true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

| true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

| true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

| true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The skill is designed to read and modify ~/.codex configuration, including changing the active config symlink, which directly affects another agent/tool’s execution behavior. Access to agent config directories is sensitive because it enables persistence, redirection to attacker-controlled endpoints, silent model/provider switching, and credential exposure through config tampering.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

└── custom.toml — 自定义 OpenAI 兼容端点(自动探测,直连或经 relay 端口 4449)

text

`~/.codex/config.toml` 是一个快捷方式(软链接),指向当前使用的配置文件。切换模型服务 = 把快捷方式指向另一个文件。

---

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

The skill states that API keys are stored in ~/.bashrc and ~/.codex profile files, both of which are high-sensitivity locations affecting future sessions and tool behavior. Persisting secrets in shell startup files and agent config directories increases the blast radius of any local compromise and creates durable credential exposure beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

md

## 安全规则

- 用户的 Key 只保存在 `~/.bashrc` 和 `~/.codex/profiles/*.toml` 中(用户家目录内)
- 覆盖配置前**自动备份**到 `~/.codex/config.toml.bak.<时间戳>`
- 不上传任何外部服务,不在日志中记录 Key 明文

## 不做什么

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/troubleshooting.md (reported line 32)May include surrounding context.

处方:每次调用 codex 都加 --skip-git-repo-check:

bash

codex exec --skip-git-repo-check "你的需求"

本 skill 在使用态调用模板里已经默认带这个参数,不会触发。

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 54)May include surrounding context.

如果 setup 脚本写出来的 profile 有问题:

bash

cat ~/.codex/profiles/<name>.toml
# 应该看到 wire_api = "responses",base_url 视 provider 不同
#   agentplan → http://127.0.0.1:4446/v1
#   kimi      → http://127.0.0.1:4447/v1

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 70)May include surrounding context.

如果 setup 脚本写出来的 profile 有问题:

bash

cat ~/.codex/profiles/<name>.toml
# 应该看到 wire_api = "responses",base_url 视 provider 不同
#   agentplan → http://127.0.0.1:4446/v1
#   kimi      → http://127.0.0.1:4447/v1

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 127)May include surrounding context.

如果 setup 脚本写出来的 profile 有问题:

bash

cat ~/.codex/profiles/<name>.toml
# 应该看到 wire_api = "responses",base_url 视 provider 不同
#   agentplan → http://127.0.0.1:4446/v1
#   kimi      → http://127.0.0.1:4447/v1

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 154)May include surrounding context.

如果 setup 脚本写出来的 profile 有问题:

bash

cat ~/.codex/profiles/<name>.toml
# 应该看到 wire_api = "responses",base_url 视 provider 不同
#   agentplan → http://127.0.0.1:4446/v1
#   kimi      → http://127.0.0.1:4447/v1

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/ensure-relay.sh (reported line 55)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-agentplan.sh (reported line 172)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-codingplan.sh (reported line 140)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-codingplan.sh (reported line 146)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-thirdparty.sh (reported line 185)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-thirdparty.sh (reported line 191)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/switch-profile.sh (reported line 86)May include surrounding context.

sh

# custom 上游存盘了才说明是 relay 模式;否则是原生 Responses 直连
    if [ -f "$HOME/.codex/custom-upstream" ]; then
      RELAY_PORT=4449
      RELAY_UPSTREAM="$(cat "$HOME/.codex/custom-upstream" | tr -d '[:space:]')"
    else
      exit 0   # custom 直连模式
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 100)May include surrounding context.

md

# health-check.sh — 对用户已有的 codex 配置做兼容性检查
#
# 什么时候会调用?
#   当检测到用户手动写过 ~/.codex/config.toml(不是本 skill 生成的)时,
#   doctor.sh 会自动调用本脚本,检查现有配置能否正常运行 Codex CLI。
#
# 输出: JSON 格式

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 150)May include surrounding context.

md

# health-check.sh — 对用户已有的 codex 配置做兼容性检查
#
# 什么时候会调用?
#   当检测到用户手动写过 ~/.codex/config.toml(不是本 skill 生成的)时,
#   doctor.sh 会自动调用本脚本,检查现有配置能否正常运行 Codex CLI。
#
# 输出: JSON 格式

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 152)May include surrounding context.

md

# health-check.sh — 对用户已有的 codex 配置做兼容性检查
#
# 什么时候会调用?
#   当检测到用户手动写过 ~/.codex/config.toml(不是本 skill 生成的)时,
#   doctor.sh 会自动调用本脚本,检查现有配置能否正常运行 Codex CLI。
#
# 输出: JSON 格式