ClawHub
Back to skill

Security audit

Codex Agent Enhanced

Security checks for vulnerabilities and agentic risk

Overview

This skill automates Codex through OpenClaw, but it installs persistent hooks and can send full Codex task output to Telegram, including to a hard-coded default recipient.

Review carefully before installing. Replace the default Telegram Chat ID, verify the sender path and account, avoid sending sensitive project output to external chat, back up and review ~/.codex/config.toml before adding hooks, avoid sourcing untrusted .env files, keep state files project-local, and do not enable long session retention or cron wakeups unless you understand the cross-session impact.

A.I.G

Vulnerability Patterns
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T04 · Embedded Malicious Code

Error
Location
scripts/setup.sh:38
Finding

Hard-Coded Telegram Recipient Can Receive Full Codex Completion Output

Content
View full analysis
bool: """Send a Telegram notification visible to the user.""" try: full_msg = f"[{AGENT_NAME.upper()}] 🔔 Codex task completed\n\n{msg}" proc = subprocess.Popen( [ "python3", SENDER_SCRIPT, "-m", full_msg, "-c", CHAT_ID, "-a", ACCOUNT_ID, ], stdout=subprocess.PIPE, stderr=subprocess.PIPE, ) stdout, stderr = proc.communicate(timeout=30) ``` The transmitted message is constructed from Codex-controlled completion data: ```python summary = notification.get("last-assistant-message", "Done") cwd = notification.get("cwd", "unknown") thread_id = notification.get("thread-id", "unknown") agent_msg = ( f"📁 {cwd}\n" f"💬 {summary}\n" f"thread: {thread_id}" ) send_notification(agent_msg) ``` The same numeric recipient is also embedded in `SKILL.md:107-114`, `docs/CONFIG_TEMPLATE.md:13`, and the example documentation. ### Technical Analysis The setup process supplies `7936836901` as a functional default Telegram Chat ID instead of requiring the user to enter and verify their own recipient. Pressing Enter at the prompt silently selects this fixed recipient. The persistent Codex notification hook subsequently passes the working directory, thread identifier, and complete `last-assistant-message` to a sibling `telegram-sender` component. Completion messages can contain source code, fil ...[truncated 1844 chars]
Remediation
View remediation
&2 exit 1 fi ``` 3. Display the selected recipient and require explicit confirmation before installing the hook. 4. Send a one-time verification challenge to the configured recipient and require the user to confirm it. 5. Default notifications to disabled until configuration is complete. 6. Do not transmit the complete assistant response by default. Send a minimal local task identifier and status, with an opt-in setting for detailed output. 7. Allow per-project notification policies and redact credentials, tokens, private keys, and sensitive paths. 8. Vendor and audit the sender implementation, or use a documented OpenClaw API instead of executing an unaudited sibling script. 9. Add an uninstall command that removes the hook from `~/.codex/config.toml`. 10. Rotate any notification credentials and investigate the fixed recipient if the affected default has already been deployed. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
hooks/on_complete.py:28
Finding

Environment-Controlled Project State Path Allows Arbitrary File Replacement

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
scripts/setup.sh:66
Finding

Installer Adds a Cross-Session Codex Hook and Recommends Near-Permanent Session Retention

Content
View full analysis
"$config_file" << EOF model = "gpt-5.3-codex" notify = ["python3", "$hook_path"] [features] fast_mode = true EOF elif ! grep -q "^notify" "$config_file"; then echo "" >> "$config_file" echo "notify = [\"python3\", \"$hook_path\"]" >> "$config_file" fi echo_info "✓ Codex configuration updated" } ``` The installation guide additionally instructs users to configure: ```json { "session": { "reset": { "mode": "idle", "idleMinutes": 52560000 } } } ``` The documentation describes this as effectively delaying reset for approximately 100 years. ### Technical Analysis The setup script installs a global `notify` hook in `~/.codex/config.toml`. This hook survives the setup process and is invoked by later Codex operations, including operations unrelated to the project where the skill was installed. The installer does not preserve a structured backup, provide rollback, scope the hook to a project, or clearly enumerate all data sent on every invocation. Combined with the hard-coded recipient issue, this persistence turns a one-time configuration mistake into repeated cross-session disclosure. The instruction to extend session reset to 52,560,000 idle minutes materially weakens normal data-lifecycle controls. Long-lived conversational context remains available for future agent activity and increases the consequences of account compromise, unintended context reuse, or cross-task c ...[truncated 1114 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
workflows/knowledge_update.md:13
Finding

Knowledge Update Workflow Prints Potential Codex Credentials into Agent Context

Content
View full analysis
/tmp/codex_version.txt codex features list > /tmp/codex_features.txt codex --help > /tmp/codex_help.txt codex exec --help > /tmp/codex_exec_help.txt cat ~/.codex/config.toml ``` The project's own schema documentation notes that this file can contain sensitive values such as: ```toml experimental_bearer_token = "..." ``` ### Technical Analysis The knowledge-update workflow instructs the agent to print the entire private Codex configuration. Unlike the preceding commands, the output is not redirected into a controlled local cache or filtered to the feature fields needed for comparison. `config.toml` may contain provider URLs, environment-variable names, bearer tokens, MCP server commands, local paths, notification commands, and other sensitive operational configuration. Printing the file places its content into the agent's command output and conversational context. Depending on the configured model provider and logging architecture, that content may leave the local machine or be retained in model, gateway, transcript, or debugging logs. The workflow does not require the full configuration contents to update version, features, schema, or release documentation. ### Attack Path 1. A user stores a bearer token or other sensitive value directly in `~/.codex/config.toml`. 2. The knowledge-update trigger fires because the version changed or the local state is older than seven days. 3. The agent follows the workflow and executes `cat ~/.codex/config.toml`. 4. The complete configuration enters the agent tool output and session context. 5. The content may be transmitted to the configured model provider or retained in agent and gateway logs. 6. Any party with access to those systems or logs may recover the exposed configuration. ### Impact As ...[truncated 457 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:354
Finding

Mutable Unpinned NPM Package Is Recommended for MCP Command Execution

Content
View full analysis
] type = "stdio" command = "npx" args = ["-y", "package@latest"] ``` The same pattern is repeated in `knowledge/config_schema.md:154-155`. ### Technical Analysis The configuration pattern directs `npx` to automatically download and execute the package currently associated with the mutable `latest` tag. The `-y` flag suppresses the normal installation confirmation. Because neither an exact version nor an integrity hash is specified, the effective code executed can change after the skill has been reviewed. A compromised maintainer account, malicious package release, package-name substitution, or registry compromise can therefore cause arbitrary code to run when Codex starts or invokes the configured MCP server. This is particularly dangerous in agent environments because MCP servers commonly receive project context and run with the same filesystem and network privileges as the user. ### Attack Path 1. The agent or user follows the documented configuration-management pattern. 2. An MCP server is configured as `npx -y package@latest`. 3. The package publisher, publisher account, package name, or registry is compromised, or a malicious release becomes `latest`. 4. Codex starts or invokes the MCP server. 5. `npx` downloads and executes the current package without an interactive confirmation. 6. Malicious package lifecycle or runtime code executes with the user's privileges and can access project files, environment variables, and network resources. ### Impact Assessment Successful exploitation provides arbitrary code execution as the user running Codex. The reachable scope can include source repositories, API keys in the environment, Codex configuration, SSH-accessible resources available to that user, and any external systems authorized th ...[truncated 139 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (127)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 12)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/CONFIG_TEMPLATE.md (reported line 220)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/CONFIG_TEMPLATE.md (reported line 225)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/CONFIG_TEMPLATE.md (reported line 233)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/CONFIG_TEMPLATE.md (reported line 238)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 39)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 42)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 54)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 98)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 114)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/ENHANCEMENTS.md (reported line 157)May include surrounding context.

md
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 62)May include surrounding context.

sh
- **状态文件模型** — JSON schema 包含 notificationRouting 和 activeTask 结构
- **质量判断标准** — 明确区分「Agent 自主修复」vs「需要用户拍板」的场景清单
- **去重规则** — wakeKey 生成逻辑，避免 Cron 频繁唤醒时重复通知用户
- **Cron 定时任务协作指南** — sessionTarget、heartbeat 启用、.env 传递的配置说明
- **判断流程图** — 基于 git diff --stat 的自动化决策流程

### Changed

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

In the one-click automation block, the instruction to have another agent edit ~/.codex/config.toml increases risk because it delegates modification of a security-sensitive agent configuration file without explicit approval or review. In context, this is more dangerous than the earlier manual setup step because it is coupled with automated execution and broader system changes, making unintended persistence or hook insertion easier.

Content

Scanner excerpt · INSTALL.md (reported line 142)May include surrounding context.

text
请帮我安装和配置 codex-agent skill。步骤：
1. 将 codex-agent skill 安装到 ~/.openclaw/workspace/skills/codex-agent/
2. 在 ~/.codex/config.toml 中添加 notify hook，路径指向 hooks/on_complete.py
3. 设置环境变量 CODEX_AGENT_CHAT_ID 为我的 Telegram Chat ID
4. 配置 OpenClaw session 不自动重置（idle + 52560000 分钟）
5. 设置脚本执行权限

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md
OPENCLAW_AGENT_NAME=main codex exec --full-auto -C /path/to/project "重构这个目录的代码"

# 指定模型和推理强度
OPENCLAW_AGENT_NAME=main codex exec --full-auto -m gpt-5.2 -c 'model_reasoning_effort="xhigh"' "任务描述"

# 附带图片
OPENCLAW_AGENT_NAME=main codex exec --full-auto -i screenshot.png "根据图片实现这个 UI"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The README instructs users to modify ~/.codex/config.toml to install a custom notify hook from the skill directory. Altering an agent/tool config directory to execute arbitrary local scripts on task completion creates a persistence and execution surface: if the hooked script or skill path is tampered with, future Codex runs will automatically execute attacker-controlled code.

Content

Scanner excerpt · README.md (reported line 100)May include surrounding context.

Notify Hook：任务完成自动通知

Codex 配置 ~/.codex/config.toml：

toml
notify = ["python3", "/root/.openclaw/skills/codex-agent/hooks/on_complete.py"]

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

描述把该技能定位为一个功能很广的“Codex CLI 完全体”项目经理工具，但代码片段只是一个 on_complete hook。它监听完成事件，记录日志，调用外部脚本发送 Telegram 通知，并更新项目状态文件中的 activeTask/runner 字段，供后续 Cron 巡检推进。虽然这与描述中提到的“notify hooks + 异步唤醒”有部分关联，但远不足以支撑所宣称的主要能力；相反，代码的实际主功能是通知与状态落盘。此外，向 Telegram 发送通知属于对外通信能力，描述中没有明确声明。综合来看，代码行为与声明用途存在明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

描述将该技能定位为一个“项目经理操作 Codex CLI 完全体”，核心应包括知识库维护、任务执行全流程、配置管理，以及基于 tmux 的交互和异步唤醒机制。但提供的代码块只实现了 setup.sh，作用是初始化环境：检查依赖、写入 .env、修改 Codex 配置、创建定时唤醒任务。它没有体现知识库跟踪、提示词设计/执行/监控/质量检查/迭代/汇报等主要业务行为，也没有实现 tmux 或 pane monitor 相关逻辑。相反，它还配置了 openclaw 与 Telegram 通知/cron，这属于描述未清晰声明的外部能力与资源接入。因此该代码与宣称用途存在明显的主功能偏差。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill tells the operator to source .env directly into the shell environment before running automation. Sourcing arbitrary project files executes shell syntax, so a malicious or compromised repository can run commands, alter the environment, or implant persistence when the operator follows the documented workflow.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
cd /path/to/project

# 2. 加载项目专属配置（每个项目独立，避免冲突）
source .env

# 3. 验证环境变量
echo "AGENT=$OPENCLAW_AGENT_NAME, CHAT=$OPENCLAW_AGENT_CHAT_ID"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

echo "AGENT=$OPENCLAW_AGENT_NAME, CHAT=$OPENCLAW_AGENT_CHAT_ID"

4. 执行 Codex 任务

codex exec --full-auto -C ""

text

**`.env` 文件示例**（每个项目独立一份）：

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The example .env embeds routing identifiers and workflow state values in a file likely to live inside the project directory, but the document does not address file permissions, accidental commits, or separation of secrets from repo content. This can lead to leakage of notification endpoints and workflow metadata, especially in shared or version-controlled projects.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

.env 文件示例（每个项目独立一份）：

bash
# /path/to/project/.env
OPENCLAW_AGENT_NAME="kimi-agent"
OPENCLAW_AGENT_CHAT_ID="7936836901"
OPENCLAW_AGENT_CHANNEL="telegram"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash
# 全局 export，所有项目共用同一套配置
export OPENCLAW_AGENT_NAME="main"  # 所有项目都用 main，混乱！
codex exec ...

✅ 正确做法（项目隔离）：

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Recommending repeated use of source .env across projects normalizes execution of project-controlled shell content as part of the workflow. This broadens the attack surface to any repository using the skill, making accidental command execution or credential manipulation much more plausible.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

✅ 正确做法（项目隔离）：

bash
# 项目 A
cd /path/to/project-a && source .env && codex exec ...

# 项目 B（同时运行，互不影响）
cd /path/to/project-b && source .env && codex exec ...

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

This second project example repeats the unsafe pattern of sourcing repository-local .env files prior to executing Codex. The multi-project framing makes the issue more dangerous because it encourages broad operational adoption, increasing exposure to malicious repo-supplied shell content.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

cd /path/to/project-a && source .env && codex exec ...

项目 B（同时运行，互不影响）

cd /path/to/project-b && source .env && codex exec ...

text

附加选项：

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The notification design explicitly sends Codex task information to Telegram, but the document does not require user consent, data minimization, or warnings about transmitting potentially sensitive project content to an external service. Because this skill is meant to operate on arbitrary projects and user prompts, the context makes accidental exfiltration of proprietary code, issue details, or user instructions materially more dangerous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.