T01 · Skill Instruction Hijacking
Error
- Location
hooks/on_complete.py:93- Finding
Untrusted Codex Output Is Injected into a Privileged Agent Instruction
- Content
View full analysis
- Remediation
View remediation
Security audit
Codex Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent but should be reviewed carefully because it installs persistent Codex/OpenClaw automation that can forward task output externally and act on approval prompts.
Install only if you are comfortable granting OpenClaw/Codex persistent automation over coding sessions. Use a pinned reviewed commit, avoid sensitive repositories unless notifications are redacted or disabled, keep approval decisions human-controlled for risky commands, and reconsider the 100-year session setting.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T07 · Tool Hijacking and Spoofing
Error
- Location
hooks/pane_monitor.sh:38- Finding
Terminal Output Can Spoof a Codex Approval Request
- Content
View full analysis
/dev/null) # 检测审批等待 if echo "$OUTPUT" | grep -q "Would you like to run\|Press enter to confirm\|approve this\|allow this"; then # 提取要执行的命令 CMD=$(echo "$OUTPUT" | grep '^\s*\$' | tail -1 | sed 's/^\s*\$ //') STATE="approval:$CMD" if [ "$STATE" != "$NOTIFIED_APPROVAL" ]; then NOTIFIED_APPROVAL="$STATE" MSG="⏸️ Codex 等待审批 📋 命令: ${CMD:-unknown} 🔧 session: $SESSION" # 1. 通知用户 if ! openclaw message send --channel "$CHANNEL" --target "$CHAT_ID" --message "$MSG" --silent 2>>"$LOG_FILE"; then log "⚠️ Telegram notify failed for approval" fi # 2. 唤醒 agent（后台执行，不阻塞 monitor 循环） AGENT_MSG="[Codex Monitor] 审批等待，请处理。 session: $SESSION command: ${CMD:-unknown} 请 tmux send-keys -t $SESSION '1' Enter 批准，或 '3' Enter 拒绝。" openclaw agent --agent "$AGENT_NAME" --message "$AGENT_MSG" --deliver --channel "$CHANNEL" --timeout 120 2>>"$LOG_FILE" & ``` ### Technical Analysis The monitor infers approval state by searching the last 30 lines of a tmux pane for broad text fragments such as `approve this` or `allow this`. It then identifies the alleged command by selecting the last line beginning with `$`. Terminal contents are not an authenticated event channel. A repository script, test program, command output, or model response can print these phrases and a fabricated command line. The script neither verifies that Codex generated the prompt nor correlates the extracted command with a structured approval event. The notification also instructs an autonomous agent to send approval keystrokes to the tmux session. Because the displayed command and actual active prompt can differ, this can produce a confused-deputy c ...[truncated 1397 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
hooks/on_complete.py:93- Finding
Codex Output and Command Details Are Automatically Sent to External Messaging Services
- Content
View full analysis
>"$LOG_FILE"; then log "⚠️ Telegram notify failed for approval" fi ``` ### Technical Analysis The hook forwards the complete assistant summary, working directory, and pending command details to a configurable external messaging service. The implementation explicitly acknowledges that the summary may contain code, paths, or secrets, but performs no redaction, classification, truncation, or destination validation before transmission. The destination and channel are controlled through environment variables. Although arguments are safely passed without a shell in the Python implementation, there is no allowlist ensuring that the configured destination is an approved private account. ### Attack Path 1. Codex processes a file, command output, stack trace, configuration, or environment-derived value containing sensitive information. 2. The sensitive value appears in `last-assistant-message` or in a terminal command captured by the pane monitor. 3. The hook builds a notification containing the unfiltered content. 4. `openclaw message send` tr ...[truncated 778 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
INSTALL.md:86- Finding
Installation Guidance Effectively Disables OpenClaw Session Expiration
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
INSTALL.md:16- Finding
Executable Hook Is Installed from an Unpinned Mutable Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (74)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
5. Codex notify hook 可触发（在任意 git 目录下）
cd /tmp && mkdir -p codex-test && cd codex-test && git init codex exec "say hello"
你应该在 Telegram 上收到通知
text
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is Codex project management via tmux, but the content also instructs external notification, agent wake-up, hook handling, and forwarding task context like cwd and assistant summaries to Telegram/OpenClaw channels. This hidden expansion of behavior is dangerous because users may authorize the skill for local orchestration while it also performs external communication and automation outside the stated trust boundary.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
The skill instructs modifying ~/.codex/config.toml to register a notify hook, which grants code in on_complete.py execution on every Codex turn. Touching a user-level agent config in the home directory creates a persistent execution foothold and can affect all future Codex sessions, not just this project.
- Content
md ### on_complete.py（notify hook） **配置**：`~/.codex/config.toml` → `notify = ["python3", "<path>/on_complete.py"]` **触发**：Codex 每次完成一个 turn
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
exec 模式
bash codex exec --full-auto "<prompt>" codex exec --full-auto -m gpt-5.2 -C /path "<prompt>" codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "<prompt>" codex exec --full-auto -i image.png "<prompt>"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash codex exec --full-auto "<prompt>" codex exec --full-auto -m gpt-5.2 -C /path "<prompt>" codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "<prompt>" codex exec --full-auto -i image.png "<prompt>"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash codex exec --full-auto "<prompt>" codex exec --full-auto -m gpt-5.2 -C /path "<prompt>" codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "<prompt>" codex exec --full-auto -i image.png "<prompt>"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Allowing image attachment means local files can be transmitted to the external model provider, which raises a concrete data-exfiltration risk if screenshots contain secrets, customer data, tokens, or internal UI state. In the context of an automation skill that emphasizes autonomous execution, accidental attachment of sensitive images becomes more dangerous.
- Content
codex exec --full-auto "" codex exec --full-auto -m gpt-5.2 -C /path "" codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "" codex exec --full-auto -i image.png ""
text ### 代码审查
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
The preflight checklist normalizes persistent edits to ~/.codex/config.toml and related environment setup, encouraging users to enable global hooks and notification behavior. This expands the blast radius from a single task to all Codex usage and could enable unintended persistence or ongoing data leakage.
- Content
md 首次使用前确认： - [ ] `~/.codex/config.toml` 中已添加 `notify = ["python3", "<path>/on_complete.py"]` - [ ] 环境变量 `CODEX_AGENT_CHAT_ID` 已设置（或已修改脚本中的默认值） - [ ] 环境变量 `CODEX_AGENT_NAME` 已设置（默认 `main`，通常不需要改） - [ ] `codex --version` 可用
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi # 清理日志（可选，取消注释启用） # rm -f "/tmp/codex_monitor_${SESSION}.log"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
codex features list # 全部 feature flags + 成熟度 + 状态 codex --help # CLI 参数 codex mcp list # 已配置的 MCP servers（在交互模式下用 /mcp） codex exec --help # exec 模式参数 codex review --help # review 模式参数
text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Feature Flags 通过 `codex features list` 获取，`~/.codex/config.toml` 的 `[features]` 中开关。 ### ✅ Stable（稳定，可放心使用）
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Feature Flags 通过 `codex features list` 获取，`~/.codex/config.toml` 的 `[features]` 中开关。 ### ✅ Stable（稳定，可放心使用）
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Feature Flags 通过 `codex features list` 获取，`~/.codex/config.toml` 的 `[features]` 中开关。 ### ✅ Stable（稳定，可放心使用）
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Feature Flags 通过 `codex features list` 获取，`~/.codex/config.toml` 的 `[features]` 中开关。 ### ✅ Stable（稳定，可放心使用）
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md ## Feature Flags 通过 `codex features list` 获取，`~/.codex/config.toml` 的 `[features]` 中开关。 ### ✅ Stable（稳定，可放心使用）
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash # 标准全自动执行 codex exec --full-auto "任务描述" # 指定模型 codex exec --full-auto -m gpt-5.2 "任务描述"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md codex exec --full-auto "任务描述" # 指定模型 codex exec --full-auto -m gpt-5.2 "任务描述" # 指定工作目录 codex exec --full-auto -C /path/to/project "任务描述"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md codex exec --full-auto -m gpt-5.2 "任务描述" # 指定工作目录 codex exec --full-auto -C /path/to/project "任务描述" # 运行时覆盖配置 codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "任务描述"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md codex exec --full-auto -C /path/to/project "任务描述" # 运行时覆盖配置 codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "任务描述" # 附带图片 codex exec --full-auto -i screenshot.png "根据截图修复 UI"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
codex exec --full-auto -c 'model_reasoning_effort="xhigh"' "任务描述"
附带图片
codex exec --full-auto -i screenshot.png "根据截图修复 UI"
text
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
非交互执行，完成后退出。
bash codex exec [OPTIONS] [PROMPT]额外选项：
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
codex --version > /tmp/codex_version.txt codex features list > /tmp/codex_features.txt codex --help > /tmp/codex_help.txt codex exec --help > /tmp/codex_exec_help.txt cat ~/.codex/config.toml
text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
Referencing
~/.codex/config.tomlin the workflow authorizes inspection of a sensitive agent config path without guardrails. Because the surrounding workflow also fetches remote data and updates knowledge artifacts, the local configuration could be unintentionally incorporated into notes or prompts, amplifying exposure beyond the local machine.- Content
codex features list > /tmp/codex_features.txt codex --help > /tmp/codex_help.txt codex exec --help > /tmp/codex_exec_help.txt cat ~/.codex/config.toml
text ### Step 2: 拉取远程数据
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
Referencing
~/.codex/config.tomlin the workflow authorizes inspection of a sensitive agent config path without guardrails. Because the surrounding workflow also fetches remote data and updates knowledge artifacts, the local configuration could be unintentionally incorporated into notes or prompts, amplifying exposure beyond the local machine.- Content
codex features list > /tmp/codex_features.txt codex --help > /tmp/codex_help.txt codex exec --help > /tmp/codex_exec_help.txt cat ~/.codex/config.toml
text ### Step 2: 拉取远程数据
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
验证 skill 被识别：
bash ls ~/.openclaw/workspace/skills/codex-agent/SKILL.md # 应该存在
Static analysis
No suspicious patterns detected.