T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:146- Finding
Codex Is Launched Without Sandbox or Approval Controls
- Content
View full analysis
> $LOG_FILE" tmux send-keys -t "$TASK_ID" \ 'codex -c "model_reasoning_effort=high" \ --dangerously-bypass-approvals-and-sandbox \ '"'"'Your detailed prompt here. When completely finished: 1. Commit all changes with descriptive messages 2. Push the branch: git push -u origin '"$BRANCH"' 3. Create PR: gh pr create --fill 4. Notify: openclaw system event --text "Done: '"$TASK_ID"'" --mode now'"'"' \ ; echo "CODEX_EXIT=$?" >> '"$LOG_FILE" Enter ``` The Skill subsequently justifies this configuration: ```markdown - `--dangerously-bypass-approvals-and-sandbox` is safe in container/sandbox environments ``` The same unrestricted mode is recommended or used elsewhere at `SKILL.md:27`, `SKILL.md:382`, `SKILL.md:415`, and `SKILL.md:466`. ### Technical Analysis The `--dangerously-bypass-approvals-and-sandbox` option removes both execution isolation and interactive approval controls. This gives model-generated commands the ambient permissions of the account running Codex instead of limiting them to the target workspace. The documented workflow does not verify that it is running inside a suitably isolated container or VM before enabling this mode. It also does not verify that sensitive host directories, credentials, sockets, or environment variables are unavailable inside such an environment. Merely stating that the option is safe in containers does not establish a security boundary. The workflow processes repository contents, task prompts, dependency metadata, build scripts, and failure logs. Any of these sources can contain malicious or adversarial instructions. Running Codex without a sandbox turns such content into a potential route to unrestricted local command execution. The task generally only needs work ...[truncated 1871 chars]- Remediation
View remediation