.Autopilot

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 0.5.0

Overview

This is a coherent Codex autopilot tool, but it can run unattended, approve actions, execute project-defined commands, and send status/task data to external chat services.

Install only if you intentionally want a persistent unattended Codex automation system. Use it only on trusted repositories, review task YAML and PRD command checks before enabling them, disable or tightly scope Telegram/Discord/OpenClaw integrations, remove hardcoded Discord fallback routing if not yours, and avoid auto-approval or --full-auto modes unless you accept unattended code and command changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

short_cmd = cmd if len(cmd) <= 50 else cmd[:47] + "..."
    
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 98% confidence
• Finding: The code executes a command taken from configuration via subprocess.run(..., shell=True) after only performing a string replacement for {project_dir}. If an attacker can influence done_when.commands or related task/config input, they can execute arbitrary shell commands in the project directory, making this a real command-injection/RCE risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

single_line = reply.replace('\n', ' ').replace('\r', ' ').strip()
        
        # 使用 -l (literal) 避免特殊字符被解释
        result = subprocess.run(
            [tmux, 'send-keys', '-t', f'{TMUX_SESSION}:{window_name}',
             '-l', single_line],
            capture_output=True, text=True, timeout=10

• Confidence: 96% confidence
• Finding: This sends attacker-controlled reply text into an interactive tmux pane and then submits it with Enter. Although -l avoids tmux key interpretation, the content is still delivered to whatever program owns the pane; if the pane is actually a shell or another interpreter, this becomes arbitrary command/input injection into a live session.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

time.sleep(0.1)
        
        # 发送 Enter
        result = subprocess.run(
            [tmux, 'send-keys', '-t', f'{TMUX_SESSION}:{window_name}',
             'Enter'],
            capture_output=True, text=True, timeout=5

• Confidence: 95% confidence
• Finding: The explicit Enter key commits previously injected text for execution or submission in the target pane. In the context of automated multi-session orchestration, this materially increases risk because any mis-targeted or maliciously crafted input is immediately acted upon without human confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        cmd = [codex, 'exec', 'resume', session_id, reply, '--full-auto']
        process = subprocess.Popen(
            cmd,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.PIPE,

• Confidence: 97% confidence
• Finding: This launches codex exec resume with untrusted reply content and --full-auto, allowing a message-delivery path to become autonomous action execution. If upstream inputs are attacker-controlled, the system can trigger code changes or other automated actions across projects without an interactive safeguard.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-n', name, '-c', project_dir],
                capture_output=True, timeout=5
            )
            subprocess.run(
                [tmux, 'send-keys', '-t', f'{TMUX_SESSION}:{name}',
                 codex_cmd, 'Enter'],
                capture_output=True, timeout=5

• Confidence: 99% confidence
• Finding: The code constructs a shell command string with unquoted project_dir, codex path, and session_id, injects it into tmux via send-keys, and presses Enter. Because this runs inside a shell in the pane, any metacharacters in those fields can break out of the intended command and execute arbitrary shell commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-n', name, '-c', project_dir],
                capture_output=True, timeout=5
            )
            subprocess.run(
                [tmux, 'send-keys', '-t', f'{TMUX_SESSION}:{name}',
                 codex_cmd, 'Enter'],
                capture_output=True, timeout=5

• Confidence: 99% confidence
• Finding: As above, this types a concatenated shell command into the new tmux window and executes it. If name, project_dir, session_id, or configured codex path are attacker-controlled or even just malformed, this enables arbitrary shell command execution in the project context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ax_helper = _get_ax_helper()
        if ax_helper and window.title:
            try:
                result = subprocess.run(
                    [ax_helper, 'activate', window.title],
                    capture_output=True, text=True, timeout=5
                )

• Confidence: 92% confidence
• Finding: The code executes a helper binary from user-writable locations and passes it a window title derived from external UI state. While subprocess is invoked without a shell, this is still dangerous because trust is placed in an unverified executable in paths such as ~/.autopilot or ~/.local/bin; if an attacker can replace that binary, this code becomes an arbitrary code execution primitive inside the automation workflow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'''
            
            try:
                result = subprocess.run(
                    ['osascript', '-e', script],
                    capture_output=True, text=True, timeout=5
                )

• Confidence: 97% confidence
• Finding: This AppleScript is built by string interpolation and includes window.title, which ultimately comes from external window metadata. Escaping only backslashes and double quotes is not sufficient for AppleScript contexts, so a crafted window title could break script structure or alter behavior, leading to unintended UI automation commands under the user's accessibility permissions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ax_helper = _get_ax_helper()
        if ax_helper:
            try:
                result = subprocess.run(
                    [ax_helper, 'list'],
                    capture_output=True, text=True, timeout=5
                )

• Confidence: 88% confidence
• Finding: This executes an external helper binary discovered from user-writable locations and then trusts its stdout to drive window enumeration. If ax_helper is replaced or spoofed, the process can execute arbitrary code and supply attacker-controlled window metadata that influences later routing and activation decisions in this automation system.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

run_args: Any = command
            else:
                run_args = command_list if command_list else shlex.split(command)
            proc = subprocess.run(
                run_args,
                cwd=str(cwd),
                shell=use_shell,

• Confidence: 97% confidence
• Finding: The command checker executes repository-supplied data from prd-items.yaml via subprocess.run, and it defaults to shell=True. Because the script explicitly treats repository-maintained checks as trusted, any attacker who can modify that YAML can achieve arbitrary command execution on the host running verification, including CI runners or the local automation environment. In this skill context, that risk is amplified because the tool is part of an autopilot/watchdog system intended to orchestrate multiple coding sessions and run unattended commands.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The fallback path is advertised as message delivery but actually invokes Codex in --full-auto mode, expanding scope from communication to autonomous action. In this skill's automation context, that makes prompt injection or queue poisoning much more dangerous because a malicious message can trigger unattended project modifications.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The implementation of mark_task_failed contradicts its contract and leaves a failed task in RUNNING state instead of FAILED. In an automation/orchestration skill, this can cause the scheduler or watchdog to keep treating a failed task as active, leading to repeated retries, stuck workflows, incorrect dependency handling, and unsafe autonomous continuation without proper escalation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script loads a Discord bot token from a local secrets file and sends arbitrary message content to Discord, creating an external data exfiltration capability. In a tmux/Codex orchestration skill, outbound notification may be operationally useful, but it is security-relevant and expands the trust boundary because session-derived content can be transmitted off-host without explicit disclosure or consent controls.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file advertises itself as a development update notifier to Discord, but the broader skill metadata provided to users does not mention Discord posting. That omission is security-significant because users may invoke the skill for local session orchestration without realizing it can transmit content externally using stored credentials.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The watchdog can dispatch queued work and remediation tasks to an external Claude fallback system when Codex limits are low or exhausted. That expands the trust boundary from local tmux/Codex orchestration into cross-agent task delegation and may send project context, issue contents, and task text to another external service not clearly disclosed by the stated skill scope.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The script sends Telegram and Discord notifications containing task, repository, and status details to external services. While not inherently malicious, this is data egress beyond local automation and can expose sensitive operational or codebase metadata if users were not clearly informed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document proposes a skill that collects monitor output and sends status reports to Telegram via curl, but it does not require any user-facing disclosure, data minimization, or redaction before external transmission. In an autopilot/orchestration context, status summaries may contain repository names, task details, error messages, or other sensitive operational metadata, so silent exfiltration to a third-party service creates a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises Telegram/Discord notifications, task routing, and cross-engine coordination, but does not clearly warn that project status, task content, review output, and possibly repository-derived data may be sent to external services. In an unattended multi-project automation context, users may enable this without understanding the data exfiltration and privacy implications, increasing the chance of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start instructs users to configure a Telegram bot and enable unattended monitoring/notification immediately, but omits any warning that operational metadata, task text, and possibly code-review context may be transmitted to third-party messaging services. Because this system is designed for 7×24 autonomous operation, the lack of a prominent warning materially raises the risk of silent ongoing data leakage.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: Broad triggers like 'autopilot', 'watchdog', and 'codex automation' can cause the skill to activate on generic user requests that did not intend to invoke a privileged multi-project automation system. In this context, accidental activation is risky because the skill is capable of sending commands, handling permissions, and performing networked notifications across multiple projects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The description explicitly includes automatic permission handling and Discord/Telegram notifications, but it does not provide a clear warning that data from active coding sessions may be transmitted externally or that the system may take actions on the user's behalf. In an agent automation context, that omission materially increases privacy and system-integrity risk because users may expose sensitive project content or permit unauthorized changes without realizing it.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The skill advertises trigger examples like “帮我 review 这个代码”, “检查这个 PR”, and “看看这个实现有没有问题”, which are broad, natural phrases likely to appear in ordinary conversation. In an automation/orchestration environment, overly generic triggers can cause unintended invocation of this skill, leading the agent to enter review mode when the user did not explicitly request it.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to persist task plans, findings, and errors to project files by default, but does not require informed user consent or warn that potentially sensitive prompts, environment details, and debugging artifacts may be stored on disk. In an automation/orchestration context, this increases the chance of retaining confidential data in repositories, worktrees, backups, or shared environments where it can later be exposed.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Recommending one-shot permission grants for a skill's common commands without explaining the security consequences can normalize overbroad authorization. In an agent automation setting, this can reduce human oversight and allow later command execution with more privilege than the user intended, especially if the skill or adjacent content becomes compromised or mis-triggered.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger phrases are very broad, everyday requests such as asking to review a document or PRD. In an automated multi-skill environment, generic phrases can cause unintended activation of this skill, leading to misrouting, context confusion, or the skill running on inputs the user did not intend to subject to this workflow.

VirusTotal

66/66 vendors flagged this skill as clean.