Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is for background Codex jobs, but the published package is incomplete and its setup examples can grant sensitive command-approval authority to a hardcoded Telegram account if copied as written.

Do not copy the Telegram approval config as written. Replace and verify any approver ID, avoid enabling approvals for a broad main agent, and treat TELEGRAM_BOT_TOKEN as a secret. Also verify the package includes the claimed dispatcher/worker/helper scripts before installing wrappers, and install only into a bin directory where overwriting command names is acceptable.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/local-setup.md:48
Finding: Hardcoded Telegram Account Authorized to Approve Remote Command Execution
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/install-local.sh:9
Finding: Installer Replaces Trusted Command Entries with Wrappers Targeting a Missing Executable
Content: View full analysis
"${BIN_DIR}/codex-dev-status" <"${BIN_DIR}/codex-dev-show" <` operations unconditionally truncate and replace `codex-dev-status` and `codex-dev-show`. Every installed command delegates execution to: ```text scripts/codex-dev-dispatch ``` However, that executable is absent from the audited project. The complete supplied directory contains only `scripts/install-local.sh` under `scripts/`, despite `SKILL.md` also claiming that dispatcher, worker, and Telegram helper scripts are included. The immediate result is installation of broken command aliases and wrappers. There is also a conditional tool-hijacking risk: the wrappers establish trusted command names that will execute any file subsequently placed at the missing dispatcher path. If another user, compromised process, update mechanism, or extracted package can modify that skill directory, invoking one of these commands executes the substituted file with the invoking user's permissions. The overwrite behavior is also unsafe. Existing regular files named `codex-dev-status` or `codex-dev-show` are replaced without confirmation or backup. Existing symlinks for the three `ln -sfn` destinations can similarly be redirected. With `set -e`, a conflicting no ...[truncated 1895 chars]
Remediation: View remediation
&2 exit 1 fi ``` 3. Refuse to replace existing files or symlinks unless the user supplies an explicit overwrite option. 4. Display every destination collision and obtain confirmation before replacement. 5. Back up existing commands when replacement is explicitly requested. 6. Install versioned, immutable executable files first, validate their hashes and permissions, and only then create command links atomically. 7. Ensure the installation source directory is not writable by untrusted users. 8. Avoid leaving wrappers that reference mutable development or extraction directories. 9. Run post-installation checks confirming that every installed command resolves to an existing executable and that basic help/status operations succeed. 10. Update `SKILL.md` so its file inventory exactly matches the published package. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A description-behavior mismatch is dangerous because users and upstream agents may trust the declared behavior while the actual implementation performs different actions, such as installing wrappers or modifying local command paths. That can lead to unauthorized persistence-like changes, incorrect risk decisions, and execution in environments where the skill would not have been approved if its real behavior were accurately disclosed.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises direct shell-backed operational behavior but does not declare any explicit tool scope or permissions boundary. That makes it easier for an agent or operator to invoke the skill without clear authorization constraints, increasing the chance of unintended command execution or filesystem changes beyond user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Sending completion summaries to Telegram introduces an external data egress path, and the description does not clearly warn that job details may leave the local environment. Even optional notifications can leak repository names, task content, summaries, or other sensitive metadata if users are not explicitly informed before enabling the feature.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill encourages asynchronous file modification and local retention of logs and patch artifacts, but the user-facing description does not prominently warn about those side effects. This can cause sensitive code, prompts, or secrets to be written to disk unexpectedly and leave residual artifacts that are later exposed or mishandled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file consistently presents operational guidance and examples in both English and Chinese, but does not state how the skill chooses language for user-facing interactions or that language selection is user-controlled. Under the stated policy, forcing or implicitly assuming a locale without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document instructs users to configure a Telegram bot token and chat ID via environment variables, which affects privacy and account security. While it names the values to set, it does not warn users not to commit, share, or expose the bot token.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.