Claude Code × Codex Collaborate

• Outcome: Review
• Latest audit: May 29, 2026 at 9:40 PM UTC
• Version:
  0.1.13

Overview

This looks like a real collaboration automation skill, but it needs Review because it can persist agent hooks, send broad project context to Codex, and rewrite workflow state in ways that may weaken safety pauses.

Install only in repositories where you are comfortable with local automation and Codex receiving project context. Keep loop automation off unless you explicitly want persistent hooks in .claude/settings.json, inspect docs/cccc/context-bundle.md before reviews on sensitive projects, and avoid using doctor/import/reset/repair against untrusted repos or preexisting configs without reviewing them first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stop_script = ROOT / ".claude/hooks" / "cccc-stop.sh"
    if stop_script.exists() and os.access(stop_script, os.X_OK):
        try:
            r = subprocess.run(
                ["bash", str(stop_script)],
                input='{"stop_hook_active":false}',
                capture_output=True, text=True, timeout=10,

• Confidence: 89% confidence
• Finding: r = subprocess.run( ["bash", str(stop_script)], input='{"stop_hook_active":false}', capture_output=True, text=True, timeout=10,

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if cli_path:
        record(PASS, f"Codex CLI: {cli_path}")
        try:
            ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)
            if ver.returncode == 0:
                record(PASS, f"  Codex version: {ver.stdout.strip()[:60]}")
            else:

• Confidence: 86% confidence
• Finding: ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)

Tainted flow: 'stop_script' from os.environ.get (line 182, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

stop_script = ROOT / ".claude/hooks" / "cccc-stop.sh"
    if stop_script.exists() and os.access(stop_script, os.X_OK):
        try:
            r = subprocess.run(
                ["bash", str(stop_script)],
                input='{"stop_hook_active":false}',
                capture_output=True, text=True, timeout=10,

• Confidence: 93% confidence
• Finding: r = subprocess.run( ["bash", str(stop_script)], input='{"stop_hook_active":false}', capture_output=True, text=True, timeout=10,

Tainted flow: 'cli_cmd' from os.environ.get (line 240, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if cli_path:
        record(PASS, f"Codex CLI: {cli_path}")
        try:
            ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)
            if ver.returncode == 0:
                record(PASS, f"  Codex version: {ver.stdout.strip()[:60]}")
            else:

• Confidence: 90% confidence
• Finding: ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs the agent to read and write project files and execute shell scripts, yet it declares no permissions. That mismatch is dangerous because it hides the true capability surface from users and policy tooling, reducing informed consent and making risky operations harder to audit or constrain.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The embedded Python ignores the supplied state-file argument and always writes to docs/cccc/state.json. In this workflow that can corrupt or desynchronize shared collaboration state, especially if the caller expects a different file or reuses the helper in another context. The skill context makes this more dangerous because state transitions gate whether implementation may proceed or pause for human review.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: This block has two integrity issues: it hardcodes docs/cccc/state.json and misreads positional arguments, so values intended for state path, output file, and review status can be shifted or lost. That can cause incorrect roadmap/status updates, missed human pauses, or false approval/rejection decisions in a milestone gate, which is security-relevant because the script is supposed to enforce adversarial review before implementation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script unilaterally installs and registers Claude hooks, modifies .claude/settings.json, and enables an automated stop-hook loop mode. That goes beyond passive collaboration orchestration and creates persistent agent-executed behavior in the workspace, which can alter future tool execution and continue actions without an explicit per-run user decision. In a security-sensitive environment, persistence plus automatic continuation increases the blast radius of any hook mistake, misconfiguration, or later compromise of hook scripts.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script's guidance for PAUSED_FOR_SYSTEM says continuation should require both the recommended strategy and an explicit --confirm, but the actual non-interactive state update logic later resumes based on strategy handling without enforcing that confirmation gate. This creates a policy/implementation mismatch: an automated caller can transition a workflow out of a system-error pause without the explicit acknowledgement the operator-facing text claims is required.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: For SENSITIVE_OPERATION/UNSAFE states, the script warns that explicit confirmation is required and that the safest default is to remain paused, yet the non-interactive logic allows the safe-alternative strategy to clear the pause and set READY_TO_CONTINUE with no confirmation check. In a safety gate, allowing state transition based solely on a strategy string weakens the intended human-in-the-loop control and can permit risky workflows to continue too easily.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script aggregates broad repository context into docs/cccc/context-bundle.md, including git diff output, status, and previews of untracked files, without any explicit user confirmation, warning, or opt-in gate. Although it attempts to filter some obvious secret and binary patterns, the allow/deny logic is incomplete and can still expose sensitive source, credentials stored under unexpected names, proprietary code, or other local artifacts to downstream review tooling or agents.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script persists the generated prompt and bundled project context under docs/cccc/runtime and docs/cccc/reviews without any explicit notice or minimization. In a collaboration/review skill, those artifacts may contain sensitive code, plans, or project metadata, creating an avoidable local data exposure and retention risk, especially if the repository is shared or later committed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The Codex CLI invocation sends the generated prompt and full context bundle to an external tool without an explicit user acknowledgment or visible data-sharing notice. Given this skill's purpose, the bundle may include repository content and planning details; transmitting that externally can leak sensitive information even if the sandbox is read-only, because read-only constrains filesystem writes, not outbound disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically repairs and rewrites docs/cccc/state.json during the default detect action, with no user confirmation, dry-run mode, or explicit warning. Because the repaired milestone is inferred from loosely parsed markdown files, a malformed or adversarial document can silently alter workflow state and cause the agent to resume work on the wrong milestone or clear pause conditions.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| `/cc-codex-collaborate update` | Safe migration after skill upgrade. Syncs config/state fields, commands, enabled hooks. Does NOT overwrite user planning/review history. Does NOT enable hooks if not already enabled. |
| `/cc-codex-collaborate force-update` | Force sync regardless of version number. Same as update but ignores version check. |
| `/cc-codex-collaborate resume` | Resume a paused workflow. Does NOT bypass Codex gates, safety pauses, or secret requirements. |
| `/cc-codex-collaborate reset` / `reset state` | Reset state machine runtime state and rehydrate from docs. Does NOT delete planning docs, reviews, or logs. |
| `/cc-codex-collaborate doctor` | Diagnose installation, config, hooks, Codex, gates, and context. Does NOT modify files. |
| `/cc-codex-collaborate rebuild-context` | Rebuild context-bundle.md for Codex. Does NOT modify milestone status. |
| `/cc-codex-collaborate gates` | Show plan/milestone/final/safety gate status. Does NOT modify files. |

• Confidence: 81% confidence
• Finding: reset state

Memory Manipulation

High

• Category: Memory Poisoning

Content

| `/cc-codex-collaborate update` | Safe migration after skill upgrade. Syncs config/state fields, commands, enabled hooks. Does NOT overwrite user planning/review history. Does NOT enable hooks if not already enabled. |
| `/cc-codex-collaborate force-update` | Force sync regardless of version number. Same as update but ignores version check. |
| `/cc-codex-collaborate resume` | Resume a paused workflow. Does NOT bypass Codex gates, safety pauses, or secret requirements. |
| `/cc-codex-collaborate reset` / `reset state` | Reset state machine runtime state and rehydrate from docs. Does NOT delete planning docs, reviews, or logs. |
| `/cc-codex-collaborate doctor` | Diagnose installation, config, hooks, Codex, gates, and context. Does NOT modify files. |
| `/cc-codex-collaborate rebuild-context` | Rebuild context-bundle.md for Codex. Does NOT modify milestone status. |
| `/cc-codex-collaborate gates` | Show plan/milestone/final/safety gate status. Does NOT modify files. |

• Confidence: 81% confidence
• Finding: Reset state

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Maintenance commands

### reset / reset state

Reset state machine runtime state. Run `cccc-reset.sh`. Uses `cccc-rehydrate-state.py` to infer current milestone from planning docs, reviews, and git history. Does NOT delete planning docs, reviews, or logs. Always creates backup.

• Confidence: 89% confidence
• Finding: reset state

Memory Manipulation

High

• Category: Memory Poisoning

Content

### reset / reset state

Reset state machine runtime state. Run `cccc-reset.sh`. Uses `cccc-rehydrate-state.py` to infer current milestone from planning docs, reviews, and git history. Does NOT delete planning docs, reviews, or logs. Always creates backup.

### doctor

• Confidence: 89% confidence
• Finding: Reset state

VirusTotal

66/66 vendors flagged this skill as clean.