Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it says, but it handles a high-privilege CPA admin key and destructive auth-file deletion with insecure defaults and limited safeguards.
Install only if you operate the CPA server and understand that this can disable and permanently delete Codex auth records. Prefer CPA_KEY from an environment variable or secret store, restrict config.json permissions, use HTTPS CPA URLs, avoid untrusted endpoints, and test status/check before running clean, delete, or monitor mode.
scripts/codex_cleaner.py:50CPA Administrative Credential Stored in a Plaintext Configuration File Without Enforced Access Controls
scripts/codex_cleaner.py:185CPA Administrative Bearer Credential Can Be Transmitted Over Unencrypted or Unvalidated Endpoints
The skill describes capabilities that can access environment variables, write files, and perform network operations, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this weakens reviewability and least-privilege controls, making it easier for the skill to be invoked with broader capabilities than users or operators expect.
The documented workflow disables and permanently deletes authentication files, but it does not prominently warn that these actions are destructive and may remove valid credentials if the verification logic is wrong or the backend is unstable. Users may run the commands without understanding the operational impact, increasing the chance of accidental service disruption or data loss.
The script stores the CPA admin key in config.json in plaintext without a clear warning, permission hardening, or a safer secret-storage option. If the local filesystem is accessible to other users, backups, sync tools, or accidental commits, the admin credential could be exposed and used to manage or delete auth files via the CPA API.
The report format section shows user-facing output entirely in Chinese, which implies a fixed locale for the skill's messaging. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale limitation is clearly documented and justified.
The module docstring, setup wizard prompts, and many user-facing messages are written in Chinese, which imposes a specific language on users. The file does not indicate that this is a region-specific tool or provide any user opt-in or alternative locale.
The manifest frames the skill as monitoring and cleaning invalid codex auth files from CPA, but the code also implements an interactive setup wizard that collects and persists notification settings and formats output specifically for Telegram/Discord workflows. These are adjacent operational conveniences, but they go beyond the core described behavior of checking quota status, disabling 401 files, and deleting them after verification.
The manifest description emphasizes cleaning invalid auth files and when to invoke the skill, but the code also exposes a standalone monitor mode that runs indefinitely in a loop on a timed interval. Continuous daemon-like monitoring is a broader operational capability than a one-shot cleaning action and is not stated in the manifest text.
No suspicious patterns detected.