codex-mcp-dev

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed helper for delegating local coding tasks to Codex through MCP, with meaningful power to change a repository but no evidence of hidden, deceptive, or unrelated behavior.

Install this only if you want an OpenClaw agent to delegate real repository work to your local Codex setup. Review prompts before using full-auto, set --cwd to the intended project, avoid --yolo or danger-full-access unless explicitly needed, and inspect diffs/tests after each run.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands and enables local code/tool execution but does not declare any explicit tool scope such as allowed-tools or permissions. That makes the capability boundary implicit, which increases the chance that an agent or reviewer underestimates what the skill can do and allows broader execution than intended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description is broadly worded to activate on many common software-development requests, which can cause this powerful skill to be selected by default even when a simpler or safer approach would suffice. In context, that increases exposure to autonomous shell use and code modification across routine tasks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends `ask --full-auto` for implementation, refactoring, and test-writing, which authorizes autonomous repository modification. Although the document later suggests validation, it does not provide a prominent warning that this mode can change files and execute actions in the target repo, creating a meaningful risk of unintended or unsafe changes.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

def run(cmd: list[str], *, timeout_ms: int | None = None) -> subprocess.CompletedProcess[str]:
    timeout = None if timeout_ms is None else max(1, timeout_ms / 1000)
    return subprocess.run(cmd, text=True, capture_output=True, timeout=timeout)

• Confidence: 82% confidence
• Finding: The helper allows timeout=None, which permits child processes to run indefinitely. In this skill's context, the script brokers requests to local development tools that may perform expensive or hanging operations, so an unbounded call can tie up the agent, consume resources, or stall automation pipelines.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd: list[str], *, timeout_ms: int | None = None) -> subprocess.CompletedProcess[str]:
    timeout = None if timeout_ms is None else max(1, timeout_ms / 1000)
    return subprocess.run(cmd, text=True, capture_output=True, timeout=timeout)


def require_binary(name: str) -> str:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.