T09 · Insecure Skill Coding Practices
- Location
scripts/cccc-build-context.sh:88- Finding
Tracked Secrets Can Be Included in Codex Review Input
- Content
View full analysis
Vulnerability Details
File Location:
scripts/cccc-build-context.sh:88-98; downstream transmission atscripts/cccc-codex-milestone-review.sh:35-47,69-75
Vulnerability Type: Sensitive data exposure through insufficiently filtered model context
Risk Level: HighVulnerable Code
sh echo "\n## Git diff stat" git diff --stat 2>/dev/null || true echo "\n## Git diff" git diff -- . ':!docs/cccc/context-bundle.md' 2>/dev/null || true echo "\n## Untracked Files" echo "Listing untracked files:" git ls-files --others --exclude-standard 2>/dev/null || trueThe generated context is subsequently copied into the Codex prompt and supplied to the configured CLI:
sh CONTEXT="$($SCRIPT_DIR/cccc-build-context.sh)" STAMP="$(date -u +"%Y%m%dT%H%M%SZ")" OUT="docs/cccc/reviews/milestones/${MILESTONE_ID}-r${REVIEW_ROUND}-${STAMP}.json" PROMPT="docs/cccc/runtime/${MILESTONE_ID}-review-prompt-$STAMP.md" mkdir -p docs/cccc/reviews/milestones docs/cccc/runtime cat > "$PROMPT" <<EOF2 $(cat "$SKILL_DIR/prompts/codex-milestone-review.md") --- # Context Bundle $(cat "$CONTEXT") EOF2sh if "$CLI_CMD" exec \ --cd "$ROOT" \ --sandbox read-only \ --output-schema "$SKILL_DIR/schemas/codex-milestone-review.schema.json" \ --output-last-message "$OUT" \ - < "$PROMPT" 2>/dev/null; then SUCCESS=true fiTechnical Analysis
The context builder applies filename and file-type filtering only when previewing untracked files. It does not apply equivalent filtering to the tracked Git diff. The unrestricted
git diffoutput is written todocs/cccc/context-bundle.md, duplicated into a runtime prompt, and passed to the configured Codex CLI.Consequently, a tracked file containing a password, API token, private key, customer record, production configuration, or other sensitive value can have that value included in model input whenever it is added or changed in the working tree.
The read-only Codex sandbox limits filesystem modification by Co ...[truncated 1840 chars]
- Remediation
View remediation
Remediation Suggestions
- Generate diffs file by file and apply the same sensitive-path exclusions used for untracked files before reading any content.
- Add content-based secret detection using established patterns or a dedicated scanner before writing context or invoking Codex.
- Redact detected values rather than relying solely on filename extensions.
- Provide a project-level exclusion file for paths that must never enter model context.
- Exclude known sensitive paths such as environment files, credentials, keys, production configuration, private datasets, and generated secret stores from both diff content and filename listings.
- Abort the review and require explicit human approval whenever secret scanning produces a positive or uncertain result.
- Present the exact files that will be included before the first external model call.
- Store context and runtime prompts with restrictive permissions and delete transient prompt files after review when retention is unnecessary.
- Document whether the configured Codex provider receives repository content and what retention policy applies.
- Add tests proving that tracked secret-like files and secret values embedded in ordinary filenames cannot enter the generated context.