T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:146
- Finding
- Codex Is Launched Without Sandbox or Approval Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:146-173` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```bash tmux pipe-pane -t "$TASK_ID" -o "stdbuf -oL cat >> $LOG_FILE" tmux send-keys -t "$TASK_ID" \ 'codex -c "model_reasoning_effort=high" \ --dangerously-bypass-approvals-and-sandbox \ '"'"'Your detailed prompt here. When completely finished: 1. Commit all changes with descriptive messages 2. Push the branch: git push -u origin '"$BRANCH"' 3. Create PR: gh pr create --fill 4. Notify: openclaw system event --text "Done: '"$TASK_ID"'" --mode now'"'"' \ ; echo "CODEX_EXIT=$?" >> '"$LOG_FILE" Enter ``` The Skill subsequently justifies this configuration: ```markdown - `--dangerously-bypass-approvals-and-sandbox` is safe in container/sandbox environments ``` The same unrestricted mode is recommended or used elsewhere at `SKILL.md:27`, `SKILL.md:382`, `SKILL.md:415`, and `SKILL.md:466`. ### Technical Analysis The `--dangerously-bypass-approvals-and-sandbox` option removes both execution isolation and interactive approval controls. This gives model-generated commands the ambient permissions of the account running Codex instead of limiting them to the target workspace. The documented workflow does not verify that it is running inside a suitably isolated container or VM before enabling this mode. It also does not verify that sensitive host directories, credentials, sockets, or environment variables are unavailable inside such an environment. Merely stating that the option is safe in containers does not establish a security boundary. The workflow processes repository contents, task prompts, dependency metadata, build scripts, and failure logs. Any of these sources can contain malicious or adversarial instructions. Running Codex without a sandbox turns such content into a potential route to unrestricted local command execution. The task generally only needs work ...[truncated 1871 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use `--full-auto` or `-s workspace-write` as the default for implementation tasks. 2. Reserve `--dangerously-bypass-approvals-and-sandbox` for exceptional operations that cannot be completed in workspace-write mode. 3. Require explicit user confirmation immediately before enabling unrestricted execution. 4. Programmatically verify isolation rather than relying on documentation. The environment should have: - No unnecessary host-directory mounts. - No Docker or orchestration control sockets. - No SSH agent socket. - No unrelated source-control or cloud credentials. - A non-root user. - A read-only base filesystem where practical. - Network egress restrictions. - Resource and process limits. 5. Separate Git push and PR creation from the coding process. Review generated changes before performing authenticated remote operations. 6. Keep credential-bearing operations in a distinct, narrowly scoped process that Codex cannot invoke directly. 7. Treat repository text, dependency scripts, task descriptions, and logs as untrusted input. 8. Update the documentation to state that containers and VMs are only safe when their mounts, credentials, network access, and privileges have been explicitly restricted. ]]>