Skill2Team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.9.2

Overview

The skill fits its team-design purpose, but its Codex package and registration helpers can persist new agents and contain security flaws around untrusted source text and local file paths.

Install only if you intentionally want a Codex-focused team/package generator. Before running its registration helpers on any package or source from another party, inspect generated .codex/agents TOML, .codex/config.toml changes, registry manifests, and bundled source-resources; avoid bundle mode for untrusted source roots until path containment and symlink handling are fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/generate_deployment_package.py:616

Finding

Source-controlled workflow text is persisted as authoritative Codex developer instructions

Content

View full analysis

str: constraints = constraints_for_agent( agent, source_derived_runtime_constraints(plan), entry, ) lines = [ "", "Design/package conformance guard:", "- Treat source-derived runtime constraints as hard package requirements, not as optional notes.", "- If a requested execution would drop a required count, schema, stage-internal deliverable, human wait, gate, checkpoint, terminal boundary, route restriction, or source-resource dependency, stop with `design-package conformance blocked`.", "- On conformance failure, report `reexecution_required=true`, name the earliest responsible phase, and do not patch downstream artifacts ad hoc.", "- Read `design-package-conformance.contract.json`, `runtime-instruction-conformance.json`, `workflow-preservation-gate.json`, `flow-control.contract.json`, and `agent-profiles.json` before claiming package-faithful execution.", ] responsibilities = as_list(agent.get("responsibilities") or [mission(agent)]) if responsibilities: lines.append("Role responsibilities:") lines.extend(f"- {compact_text(item, 220)}" for item in responsibilities) non_resp = as_list(agent.get("non_responsibilities", [])) if non_resp: lines.append("Non-responsibilities:") lines.extend(f"- {compact_text(item, 220)}" for item in non_resp) handoffs = as_list(agent.get("handoff_contract", [])) if handoffs: lines.append("Handoff contract:") lines.extend(f"- {compact_text(item, 220)}" for item in handoffs) ...[truncated 6313 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/register_codex_agents.py:167

Finding

Package registry path traversal permits reads outside the package directory

Content

View full analysis

Remediation

View remediation

.toml`. 5. Ensure the selected filename matches the registry `agent_id` rather than using arbitrary `source.name`. 6. Validate that each artifact is a regular file and impose a reasonable size limit. 7. Parse the TOML before installation and reject unsupported or dangerous configuration fields. 8. Include artifact hashes in the package registry and verify them before registration. 9. Apply the same containment validation in both readiness checking and actual registration to prevent check/use discrepancies. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/generate_deployment_package.py:347

Finding

Source resource bundling follows paths and symlinks outside the declared source root

Content

View full analysis

tuple[list[str], list[str]]: if bundle_mode != "bundle": return [], [] if not source_root: return [], ["source_root is required for resource bundling"] src_root = Path(source_root).resolve() if not src_root.exists() or not src_root.is_dir(): return [], [f"source_root does not exist or is not a directory: {source_root}"] bundle_root = out / "source-resources" copied: list[str] = [] blockers: list[str] = [] candidate_rels: list[Path] = [] if isinstance(source_inventory, dict): for group, value in source_inventory.items(): group_path = src_root / group if group_path.exists(): candidate_rels.append(Path(group)) continue for item in as_list(value) if not isinstance(value, dict) else []: if isinstance(item, str) and item and not item.startswith("<") and not item.endswith(">"): if group == "root_files": candidate_rels.append(Path(item)) elif Path(item).suffix or "/" in item or "\\" in item: candidate_rels.append(Path(group) / item if not Path(item).is_absolute() else Path(item)) else: for group in ("references", "scripts", "templates", "assets", "examples", "data", "agents"): if (src_root / group).exists(): candidate_rels.append(Path(group)) seen: set[str] = set() for rel in candidate_rels: if rel.is_absolute(): try: rel = rel.resolve().relative_to(src_root) except ValueError: block ...[truncated 3107 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The instructions reference installation into the local Codex runtime, modification of .codex/config.toml, writes under agent-registration directories, and removal/unregister flows, while the public description frames the skill as design-oriented. Hidden or under-disclosed runtime modification is dangerous because it can persist changes, alter agent execution behavior, and affect future sessions beyond the immediate request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The instructions reference installation into the local Codex runtime, modification of .codex/config.toml, writes under agent-registration directories, and removal/unregister flows, while the public description frames the skill as design-oriented. Hidden or under-disclosed runtime modification is dangerous because it can persist changes, alter agent execution behavior, and affect future sessions beyond the immediate request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The instructions reference installation into the local Codex runtime, modification of .codex/config.toml, writes under agent-registration directories, and removal/unregister flows, while the public description frames the skill as design-oriented. Hidden or under-disclosed runtime modification is dangerous because it can persist changes, alter agent execution behavior, and affect future sessions beyond the immediate request.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The instructions reference installation into the local Codex runtime, modification of .codex/config.toml, writes under agent-registration directories, and removal/unregister flows, while the public description frames the skill as design-oriented. Hidden or under-disclosed runtime modification is dangerous because it can persist changes, alter agent execution behavior, and affect future sessions beyond the immediate request.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

Source material can be a skill zip/folder, `SKILL.md`, existing agents, generated team package, prompts, tools, scripts, docs, SOPs, manual workflows, or a natu

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/generate_deployment_package.py (reported line 2203)May include surrounding context.

python

"source_startup_reference": preservation["source_startup_reference"],
        "source_startup_adaptation_rule": (
            "Use the source skill startup page only as a workflow/content reference. "
            "Rewrite skill-language into entry-agent language: ask the user to start or use the generated entry agent, "
            "name the generated team roles, and do not copy source self-invocation wording verbatim."
        ),
        "must_render_before_first_migrated_stage": True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises broad operational behavior, including helper-script execution, package generation, and Codex registration workflows, but does not declare an explicit tool scope such as file, shell, or write permissions. That creates a capability/transparency gap: operators may invoke the skill believing it is design-only, while the instructions permit filesystem modification and shell-driven side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The prompt authorizes broad package inspection, file merging, configuration changes, testing, and agent startup without defining clear preconditions, scope limits, or user confirmation gates. In a security-sensitive environment, this can cause the agent to apply untrusted package contents into the current project and execute follow-on actions that exceed the user's likely intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to copy and merge .codex/agents files, config.toml settings, and registration JSON into the active project, but it does not warn the user that local project configuration will be modified. This increases the risk of silent persistence, altered agent behavior, or trust-boundary violations if the imported package contains unsafe or unexpected configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prompt instructs the agent to start the registered entry agent with the user's source task, but it does not warn that this will trigger execution of another agent using the user's task context. That creates a significant risk of unintended delegation, propagation of sensitive context, and execution of unreviewed instructions from the registered package.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The alias list includes highly generic natural-language phrases such as "skill to team" and "skills to agents," which can overlap with ordinary user requests rather than explicit invocation intent. In a globally discoverable, user-invocable skill, this raises the risk of accidental routing or unintended activation, potentially causing the agent to enter a team-design workflow when the user did not mean to invoke this specific skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description grants very broad capabilities like searching, fact verification, analysis, report writing, quality checking, and repeated revisions without defining when the skill should be invoked or what boundaries apply. This can cause overbroad routing and unintended use in contexts involving sensitive data, high-impact decisions, or autonomous multi-step actions, especially since it also suggests transforming workflows into multi-agent teams.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document uses prescriptive natural language such as 'OpenAI Codex is the default runner' and 'Package-end prompts remain Codex-only,' which forces a specific platform/vendor choice. Under the policy, language or locale-style constraints must be optional, user-selectable, or clearly justified; this file does not present that choice as opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Lines L03-L08 require package documentation, prompts, reports, tables, and final deliverables to be written in English by default. While L13 allows a per-response override, the default still forces a specific language for many human-facing outputs rather than offering user choice up front.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file contains natural-language policy constraints that force a specific platform/model path by default: "OpenAI Codex default". Under the stated policy category, forced language/locale-style constraints without opt-in should be flagged; here the document repeatedly mandates a specific runtime/service rather than presenting it as a user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This line requires every package reply to end with "paste-ready Codex package-use prompts only," which excludes alternatives and imposes a fixed usage path. The policy calls for flagging natural-language constraints that force a specific language/locale-style choice without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ensure_codex_meta_team.py (reported line 112)May include surrounding context.

python

def run(cmd: list[str]) -> subprocess.CompletedProcess[str]:
    return subprocess.run(cmd, text=True, capture_output=True, check=False)


def generate_meta_package(package_dir: Path, *, route: str, current_run_fanout_status: str) -> None:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The helper creates or rewrites .codex/config.toml to add feature flags, agent settings, and agent config blocks, which changes project runtime behavior. This file write is safety-relevant and lacks a user-facing warning at the point of modification; users invoking the script are not explicitly told that their Codex project configuration will be edited.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The unregister path unlinks files from .codex/agents and the registration directory, which is a destructive operation. Aside from one skip message for foreign files, there is no confirmation prompt or explicit deletion warning before removal, and the deletions happen silently until after completion output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The registration flow writes TOML agent artifacts into the project's .codex/agents directory, replacing any existing file with the same name. Although the module docstring describes conservative behavior, there is no user-facing prompt, print/log statement at the write site, or explicit disclosure that existing agent files may be overwritten during registration.

Content

No source excerpt is available for this finding.