ClawHub
Back to skill

Security audit

Codex

Security checks for vulnerabilities and agentic risk

Overview

This skill is a safety-oriented guide for using Codex, and its sensitive behaviors are disclosed, bounded, and tied to that purpose.

Install this only if you want Codex workflow guidance and are comfortable with Codex sending selected prompts, repository context, and tool results to OpenAI during actual Codex runs. Treat MCP, cloud apply, app-server, full-access sandbox, and persistent ~/codex/ notes as opt-in choices that should stay under your explicit control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Agent Config Directory Access

High
Category
Agent Snooping
Content
homepage: https://clawic.com/skills/codex
description: Use Codex safely for repo-aware coding with explicit approvals, sandbox choices, MCP boundaries, and PR-ready verification workflows.
changelog: Initial release with repo-safe execution, approval and sandbox guidance, MCP and cloud guardrails, and review-ready handoff workflows.
metadata: {"clawdbot":{"emoji":"🧭","requires":{"bins":["codex"],"bins.optional":["git","rg"],"env.optional":["OPENAI_API_KEY"],"config":["~/codex/","~/.codex/config.toml"]},"os":["linux","darwin","win32"],"configPaths":["~/codex/","~/.codex/config.toml"]}}
---

## When to Use
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High
Category
Agent Snooping
Content
homepage: https://clawic.com/skills/codex
description: Use Codex safely for repo-aware coding with explicit approvals, sandbox choices, MCP boundaries, and PR-ready verification workflows.
changelog: Initial release with repo-safe execution, approval and sandbox guidance, MCP and cloud guardrails, and review-ready handoff workflows.
metadata: {"clawdbot":{"emoji":"🧭","requires":{"bins":["codex"],"bins.optional":["git","rg"],"env.optional":["OPENAI_API_KEY"],"config":["~/codex/","~/.codex/config.toml"]},"os":["linux","darwin","win32"],"configPaths":["~/codex/","~/.codex/config.toml"]}}
---

## When to Use
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

External Model or Provider Selection

High
Category
Excessive Agency
Content
These are not routine convenience flags:

```bash
codex exec --dangerously-bypass-approvals-and-sandbox ...
codex exec -s danger-full-access -a never ...
```
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
codex exec --dangerously-bypass-approvals-and-sandbox ...
codex exec -s danger-full-access -a never ...
```

Only use them when:
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
If the environment intentionally uses an API key flow:

```bash
printenv OPENAI_API_KEY | codex login --with-api-key
```

## First Safe Run
Confidence
70% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

External Model or Provider Selection

High
Category
Excessive Agency
Content
Start with a no-surprises command in a known repo:

```bash
codex exec -C /path/to/repo -s read-only -a on-request \
  "Inspect this repository and summarize the stack, entrypoints, and test surface."
```
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
When local inference is the goal, Codex can route to an OSS provider:

```bash
codex exec --oss --local-provider ollama ...
codex exec --oss --local-provider lmstudio ...
```
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
codex exec --oss --local-provider ollama ...
codex exec --oss --local-provider lmstudio ...
```

Do not treat local-provider mode as equivalent to hosted Codex behavior; capability and reliability can differ significantly.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Hidden Instructions

High
Category
Prompt Injection
Content
integration: pending | done | declined

## Context
<!-- What the user is using Codex for and why -->
<!-- Example: PR-ready bugfixes in approved repos with explicit review evidence -->

## Safety Defaults
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

External Model or Provider Selection

High
Category
Excessive Agency
Content
Use `codex exec` when the task and the safety posture are already clear:

```bash
codex exec -C /path/to/repo \
  -s workspace-write \
  -a on-request \
  "Inspect the failing test, patch minimally, run the targeted test, and summarize the outcome."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
Or in bounded exec form:

```bash
codex exec review -C /path/to/repo
```

Treat review output as severity-ranked findings, not as generic prose.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
When another system needs machine-readable output, use a schema:

```bash
codex exec --output-schema final-schema.json ...
```

This is better than post-processing vague prose after the fact.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

MCP Config Access

High
Category
Agent Snooping
Content
- the run suddenly depends on external tools or data

Checks:
1. list MCP servers in play
2. remove any server not required for the current task
3. prefer the narrowest local workflow over broad remote access
Confidence
80% confidence
Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Static analysis

No suspicious patterns detected.