ClawHub
Back to skill

Security audit

Codex

Security checks for vulnerabilities and agentic risk

Overview

This skill is a safety-oriented guide for using Codex, and its sensitive behaviors are disclosed, bounded, and tied to that purpose.

Install this only if you want Codex workflow guidance and are comfortable with Codex sending selected prompts, repository context, and tool results to OpenAI during actual Codex runs. Treat MCP, cloud apply, app-server, full-access sandbox, and persistent ~/codex/ notes as opt-in choices that should stay under your explicit control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
homepage: https://clawic.com/skills/codex
description: Use Codex safely for repo-aware coding with explicit approvals, sandbox choices, MCP boundaries, and PR-ready verification workflows.
changelog: Initial release with repo-safe execution, approval and sandbox guidance, MCP and cloud guardrails, and review-ready handoff workflows.
metadata: {"clawdbot":{"emoji":"🧭","requires":{"bins":["codex"],"bins.optional":["git","rg"],"env.optional":["OPENAI_API_KEY"],"config":["~/codex/","~/.codex/config.toml"]},"os":["linux","darwin","win32"],"configPaths":["~/codex/","~/.codex/config.toml"]}}
---

## When to Use

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
homepage: https://clawic.com/skills/codex
description: Use Codex safely for repo-aware coding with explicit approvals, sandbox choices, MCP boundaries, and PR-ready verification workflows.
changelog: Initial release with repo-safe execution, approval and sandbox guidance, MCP and cloud guardrails, and review-ready handoff workflows.
metadata: {"clawdbot":{"emoji":"🧭","requires":{"bins":["codex"],"bins.optional":["git","rg"],"env.optional":["OPENAI_API_KEY"],"config":["~/codex/","~/.codex/config.toml"]},"os":["linux","darwin","win32"],"configPaths":["~/codex/","~/.codex/config.toml"]}}
---

## When to Use

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · approvals-and-sandbox.md (reported line 29)May include surrounding context.

These are not routine convenience flags:

bash
codex exec --dangerously-bypass-approvals-and-sandbox ...
codex exec -s danger-full-access -a never ...

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · approvals-and-sandbox.md (reported line 30)May include surrounding context.

bash
codex exec --dangerously-bypass-approvals-and-sandbox ...
codex exec -s danger-full-access -a never ...

Only use them when:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · install-and-auth.md (reported line 31)May include surrounding context.

If the environment intentionally uses an API key flow:

bash
printenv OPENAI_API_KEY | codex login --with-api-key

First Safe Run

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · install-and-auth.md (reported line 39)May include surrounding context.

Start with a no-surprises command in a known repo:

bash
codex exec -C /path/to/repo -s read-only -a on-request \
  "Inspect this repository and summarize the stack, entrypoints, and test surface."

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · mcp-and-cloud.md (reported line 53)May include surrounding context.

When local inference is the goal, Codex can route to an OSS provider:

bash
codex exec --oss --local-provider ollama ...
codex exec --oss --local-provider lmstudio ...

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · mcp-and-cloud.md (reported line 54)May include surrounding context.

bash
codex exec --oss --local-provider ollama ...
codex exec --oss --local-provider lmstudio ...

Do not treat local-provider mode as equivalent to hosted Codex behavior; capability and reliability can differ significantly.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 15)May include surrounding context.

md
integration: pending | done | declined

## Context
<!-- What the user is using Codex for and why -->
<!-- Example: PR-ready bugfixes in approved repos with explicit review evidence -->

## Safety Defaults

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · repo-execution.md (reported line 30)May include surrounding context.

Use codex exec when the task and the safety posture are already clear:

bash
codex exec -C /path/to/repo \
  -s workspace-write \
  -a on-request \
  "Inspect the failing test, patch minimally, run the targeted test, and summarize the outcome."

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · repo-execution.md (reported line 53)May include surrounding context.

Or in bounded exec form:

bash
codex exec review -C /path/to/repo

Treat review output as severity-ranked findings, not as generic prose.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · review-and-handoffs.md (reported line 27)May include surrounding context.

When another system needs machine-readable output, use a schema:

bash
codex exec --output-schema final-schema.json ...

This is better than post-processing vague prose after the fact.

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · troubleshooting.md (reported line 53)May include surrounding context.

md
- the run suddenly depends on external tools or data

Checks:
1. list MCP servers in play
2. remove any server not required for the current task
3. prefer the narrowest local workflow over broad remote access

Static analysis

No suspicious patterns detected.