Claude Code × Codex Collaborate

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.1.13

Overview

This looks like a real collaboration automation skill, but it needs Review because it can persist agent hooks, send broad project context to Codex, and rewrite workflow state in ways that may weaken safety pauses.

Install only in repositories where you are comfortable with local automation and Codex receiving project context. Keep loop automation off unless you explicitly want persistent hooks in .claude/settings.json, inspect docs/cccc/context-bundle.md before reviews on sensitive projects, and avoid using doctor/import/reset/repair against untrusted repos or preexisting configs without reviewing them first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stop_script = ROOT / ".claude/hooks" / "cccc-stop.sh"
    if stop_script.exists() and os.access(stop_script, os.X_OK):
        try:
            r = subprocess.run(
                ["bash", str(stop_script)],
                input='{"stop_hook_active":false}',
                capture_output=True, text=True, timeout=10,

• Confidence: 89% confidence
• Finding: The doctor script executes .claude/hooks/cccc-stop.sh from the repository workspace during a diagnostic run. In a skill context, repository contents are potentially adversarial, so merely running the doctor can execute attacker-controlled shell code with the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if cli_path:
        record(PASS, f"Codex CLI: {cli_path}")
        try:
            ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)
            if ver.returncode == 0:
                record(PASS, f"  Codex version: {ver.stdout.strip()[:60]}")
            else:

• Confidence: 86% confidence
• Finding: The command to execute is taken from config.codex.cli_command and then run directly. Even without shell=True, an attacker controlling project config can redirect execution to an arbitrary binary on PATH or an attacker-chosen executable, causing unintended code execution during diagnostics.

Tainted flow: 'stop_script' from os.environ.get (line 182, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

stop_script = ROOT / ".claude/hooks" / "cccc-stop.sh"
    if stop_script.exists() and os.access(stop_script, os.X_OK):
        try:
            r = subprocess.run(
                ["bash", str(stop_script)],
                input='{"stop_hook_active":false}',
                capture_output=True, text=True, timeout=10,

• Confidence: 93% confidence
• Finding: stop_script is derived from ROOT, which itself can come from environment input, and the script is then executed. This creates a clear trust-boundary violation: an attacker can influence which repository-local hook file gets run, leading to arbitrary code execution from untrusted project content.

Tainted flow: 'cli_cmd' from os.environ.get (line 240, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if cli_path:
        record(PASS, f"Codex CLI: {cli_path}")
        try:
            ver = subprocess.run([cli_cmd, "--version"], capture_output=True, text=True, timeout=10)
            if ver.returncode == 0:
                record(PASS, f"  Codex version: {ver.stdout.strip()[:60]}")
            else:

• Confidence: 90% confidence
• Finding: cli_cmd originates from project-controlled configuration and is later executed. Because this is a collaboration skill operating over workspace files, that configuration should be treated as adversarial; a malicious project can cause the diagnostic tool to run arbitrary executables.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs the agent to read and write project files and execute shell scripts, yet it declares no permissions. That mismatch is dangerous because it hides the true capability surface from users and policy tooling, reducing informed consent and making risky operations harder to audit or constrain.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The embedded Python ignores the supplied state-file argument and always writes to docs/cccc/state.json. In this workflow that can corrupt or desynchronize shared collaboration state, especially if the caller expects a different file or reuses the helper in another context. The skill context makes this more dangerous because state transitions gate whether implementation may proceed or pause for human review.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: This block has two integrity issues: it hardcodes docs/cccc/state.json and misreads positional arguments, so values intended for state path, output file, and review status can be shifted or lost. That can cause incorrect roadmap/status updates, missed human pauses, or false approval/rejection decisions in a milestone gate, which is security-relevant because the script is supposed to enforce adversarial review before implementation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script unilaterally installs and registers Claude hooks, modifies .claude/settings.json, and enables an automated stop-hook loop mode. That goes beyond passive collaboration orchestration and creates persistent agent-executed behavior in the workspace, which can alter future tool execution and continue actions without an explicit per-run user decision. In a security-sensitive environment, persistence plus automatic continuation increases the blast radius of any hook mistake, misconfiguration, or later compromise of hook scripts.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script's guidance for PAUSED_FOR_SYSTEM says continuation should require both the recommended strategy and an explicit --confirm, but the actual non-interactive state update logic later resumes based on strategy handling without enforcing that confirmation gate. This creates a policy/implementation mismatch: an automated caller can transition a workflow out of a system-error pause without the explicit acknowledgement the operator-facing text claims is required.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: For SENSITIVE_OPERATION/UNSAFE states, the script warns that explicit confirmation is required and that the safest default is to remain paused, yet the non-interactive logic allows the safe-alternative strategy to clear the pause and set READY_TO_CONTINUE with no confirmation check. In a safety gate, allowing state transition based solely on a strategy string weakens the intended human-in-the-loop control and can permit risky workflows to continue too easily.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script aggregates broad repository context into docs/cccc/context-bundle.md, including git diff output, status, and previews of untracked files, without any explicit user confirmation, warning, or opt-in gate. Although it attempts to filter some obvious secret and binary patterns, the allow/deny logic is incomplete and can still expose sensitive source, credentials stored under unexpected names, proprietary code, or other local artifacts to downstream review tooling or agents.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The script persists the generated prompt and bundled project context under docs/cccc/runtime and docs/cccc/reviews without any explicit notice or minimization. In a collaboration/review skill, those artifacts may contain sensitive code, plans, or project metadata, creating an avoidable local data exposure and retention risk, especially if the repository is shared or later committed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The Codex CLI invocation sends the generated prompt and full context bundle to an external tool without an explicit user acknowledgment or visible data-sharing notice. Given this skill's purpose, the bundle may include repository content and planning details; transmitting that externally can leak sensitive information even if the sandbox is read-only, because read-only constrains filesystem writes, not outbound disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script automatically repairs and rewrites docs/cccc/state.json during the default detect action, with no user confirmation, dry-run mode, or explicit warning. Because the repaired milestone is inferred from loosely parsed markdown files, a malformed or adversarial document can silently alter workflow state and cause the agent to resume work on the wrong milestone or clear pause conditions.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| `/cc-codex-collaborate update` | Safe migration after skill upgrade. Syncs config/state fields, commands, enabled hooks. Does NOT overwrite user planning/review history. Does NOT enable hooks if not already enabled. |
| `/cc-codex-collaborate force-update` | Force sync regardless of version number. Same as update but ignores version check. |
| `/cc-codex-collaborate resume` | Resume a paused workflow. Does NOT bypass Codex gates, safety pauses, or secret requirements. |
| `/cc-codex-collaborate reset` / `reset state` | Reset state machine runtime state and rehydrate from docs. Does NOT delete planning docs, reviews, or logs. |
| `/cc-codex-collaborate doctor` | Diagnose installation, config, hooks, Codex, gates, and context. Does NOT modify files. |
| `/cc-codex-collaborate rebuild-context` | Rebuild context-bundle.md for Codex. Does NOT modify milestone status. |
| `/cc-codex-collaborate gates` | Show plan/milestone/final/safety gate status. Does NOT modify files. |

• Confidence: 81% confidence
• Finding: This duplicate finding points to the same reset command entry. The risk is the same: state rehydration can change the workflow's effective memory and thereby influence future actions or approvals if protections fail.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| `/cc-codex-collaborate update` | Safe migration after skill upgrade. Syncs config/state fields, commands, enabled hooks. Does NOT overwrite user planning/review history. Does NOT enable hooks if not already enabled. |
| `/cc-codex-collaborate force-update` | Force sync regardless of version number. Same as update but ignores version check. |
| `/cc-codex-collaborate resume` | Resume a paused workflow. Does NOT bypass Codex gates, safety pauses, or secret requirements. |
| `/cc-codex-collaborate reset` / `reset state` | Reset state machine runtime state and rehydrate from docs. Does NOT delete planning docs, reviews, or logs. |
| `/cc-codex-collaborate doctor` | Diagnose installation, config, hooks, Codex, gates, and context. Does NOT modify files. |
| `/cc-codex-collaborate rebuild-context` | Rebuild context-bundle.md for Codex. Does NOT modify milestone status. |
| `/cc-codex-collaborate gates` | Show plan/milestone/final/safety gate status. Does NOT modify files. |

• Confidence: 81% confidence
• Finding: This duplicate finding points to the same reset command entry. The risk is the same: state rehydration can change the workflow's effective memory and thereby influence future actions or approvals if protections fail.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Maintenance commands

### reset / reset state

Reset state machine runtime state. Run `cccc-reset.sh`. Uses `cccc-rehydrate-state.py` to infer current milestone from planning docs, reviews, and git history. Does NOT delete planning docs, reviews, or logs. Always creates backup.

• Confidence: 89% confidence
• Finding: The maintenance section confirms a concrete reset script that reconstructs current milestone state from planning docs, reviews, and git history. Because this runtime state governs resumptions, gating, and automation, a flawed or misused reset path could manipulate the agent's memory of what has happened and enable unsafe continuation.

Memory Manipulation

High

• Category: Memory Poisoning

Content

### reset / reset state

Reset state machine runtime state. Run `cccc-reset.sh`. Uses `cccc-rehydrate-state.py` to infer current milestone from planning docs, reviews, and git history. Does NOT delete planning docs, reviews, or logs. Always creates backup.

### doctor

• Confidence: 89% confidence
• Finding: This duplicate finding refers to the same reset-state maintenance behavior. In an agentic skill, mutable workflow state is effectively memory; letting a script reconstruct and replace it is security-relevant because it can affect future permissions and control flow.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.