Codex Deep Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:44 AM UTC
• Version: 1.0.0

Overview

This deep-search skill is not clearly malicious, but it needs Review because it runs autonomous writable searches, can send research content to Telegram, and performs an undocumented local OpenClaw wake callback.

Install only after reviewing and constraining it. Use non-sensitive queries, remove or explicitly configure Telegram delivery, disable the undocumented wake-hook behavior unless you intend it, restrict outputs to a dedicated results directory, and avoid full-auto workspace-write execution for untrusted prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/search.sh:54

Finding

Prompt Injection into a Full-Auto Codex Agent

Content

View full analysis

&1 | tee "${RESULT_DIR}/task-output.txt" ``` ### Technical Analysis The caller-controlled `PROMPT` value is interpolated directly into the instruction sent to Codex. There is no strong separation between trusted instructions and untrusted query content. Consequently, text supplied as a research query can contain additional instructions asking the nested agent to disregard the intended research task and perform unrelated actions. This risk is amplified by the following execution settings: - `--full-auto` allows the nested agent to perform tool actions without interactive approval. - `--sandbox workspace-write` gives the nested agent write access within the effective workspace. - The query is inserted as ordinary instruction text rather than being passed through a dedicated data channel or enclosed in a clearly defined, non-executable data boundary. Shell metacharacters in `PROMPT` are not directly evaluated by the outer Bash shell because the final instruction is passed as a quoted argument. The vul ...[truncated 1736 chars]

Remediation

View remediation

... ``` 3. Prefer a structured input mechanism supported by Codex that separates system instructions from user-supplied data. 4. Avoid `--full-auto` when processing prompts from untrusted users. Require approval for command execution and filesystem access. 5. Use a read-only sandbox for research tasks unless file writes are strictly required. 6. If writes are necessary, grant access only to a newly created, task-specific output directory. 7. Prevent the agent from accessing credentials, configuration files, source repositories, or unrelated workspace content. 8. Apply output filtering before forwarding report content to Telegram or other external services. 9. Document the nested-agent prompt-injection risk and restrict who may invoke this script. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.sh:19

Finding

Arbitrary File Truncation and Write Through Unrestricted Output Paths

Content

View full analysis

"$OUTPUT" <`. It does not canonicalize the path, enforce containment under `RESULT_DIR`, reject symbolic links, or refuse to overwrite an existing file. The default path construction is also unsafe because `TASK_NAME` is caller-controlled: ```bash OUTPUT="${RESULT_DIR}/${TASK_NAME}.md" ``` A task name containing path separators or `..` components can escape the intended result directory where the resulting parent path exists. Quoting `"$OUTPUT"` prevents shell word splitting and shell metacharacter injection, but it does not prevent absolute paths, directory traversal, or symbolic-link attacks. The same path is embedded in the instructions sent to Codex, which is expected to append content to it. The initial Bash redirection alone is sufficient to truncate the target before Codex runs. ### Attack Path #### Direct `--output` exploitation 1. An attacker identifies a sensitive or operationally important file writable by the account running the skill. 2. The attacke ...[truncated 2041 chars]

Remediation

View remediation

&2 exit 1 fi ``` 3. Reject task names equal to `.` or `..`, even if a broader validation expression is later adopted. 4. Canonicalize the result directory and candidate output path, then verify that the candidate remains beneath the canonical result directory. 5. Reject absolute paths and any input containing path separators when only a filename is expected. 6. Refuse to follow symbolic links. Use secure file-opening primitives with `O_NOFOLLOW` where available. 7. Create output files atomically and exclusively so existing files cannot be overwritten. A secure helper in a language with robust filesystem APIs is preferable to shell redirection. 8. Create a private, task-specific directory with restrictive permissions, such as mode `0700`, and place the report inside it. 9. If custom output destinations are a required feature, enforce an explicit allowlist of approved directories and require confirmation before replacing an existing file. 10. Run the skill under a dedicated least-privileged account that cannot write to source code, credentials, startup files, or application configuration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The manifest describes a deep web search skill, but the documented and detected behavior extends to Telegram transmission, local hook callbacks, reading local configuration, and persistent storage. This mismatch is dangerous because users and orchestrators may consent to a search tool while unknowingly enabling data exfiltration, local service interaction, and broader side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation recommends a dispatch flow that sends results via Telegram but does not clearly warn that user queries and derived results may be transmitted to an external messaging service. This is dangerous because sensitive research topics, personal data, or proprietary information could be disclosed off-platform without informed user consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly instructs use of shell commands, including background execution and file writes, but does not declare any tool scope such as permissions or allowed-tools. This creates a governance gap where a caller may invoke shell-capable behavior without explicit least-privilege boundaries or review of what the shell access can touch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description includes broad natural-language triggers like '帮我查一下' and 'detailed search' equivalents that overlap with ordinary user phrasing. In an agent environment, this can cause over-invocation of a shell-backed skill, increasing the chance of unnecessary external searches, data persistence, or message callbacks for benign requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

Using 'nohup' to launch a background task creates session persistence beyond the initiating interaction, which can outlive user awareness and normal conversational control. In this skill's context, the persisted process may continue network activity, write files, and deliver results externally, making unintended or stale tasks harder to monitor and stop.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Dispatch Mode (recommended — background + callback)

bash

nohup bash /home/ubuntu/clawd/skills/codex-deep-search/scripts/search.sh \
  --prompt "Your research query" \
  --task-name "notebooklm-research" \
  --telegram-group "-5006066016" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script stores the user prompt in metadata and then sends it to external tooling/services without any explicit consent or warning beyond local status logging. For a deep-search skill, transmitting the query to the search backend is expected, but silently persisting and reusing raw prompt text increases exposure of potentially sensitive user input.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill performs an additional outbound action by sending search results and the original query to Telegram, which is not necessary for core deep-search functionality. This creates a privacy and data-exfiltration risk because prompts, output paths, and result summaries may contain sensitive user information and are transmitted to a third-party messaging channel when configured.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The notification text uses fixed Chinese strings such as "完成", "查询", "耗时", and "摘要" regardless of user preference or locale. This forces a specific language in user-visible output without any opt-in or documented locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads a local hook token from the user's OpenClaw configuration and uses it to trigger an internal wake hook unrelated to the advertised search task. Accessing local credentials and invoking side-effectful hooks expands the skill's privileges and creates a covert signaling channel that could be abused for orchestration, state manipulation, or unauthorized task triggering.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 152)May include surrounding context.

sh

if [[ -n "$HOOK_TOKEN" ]]; then
  WAKE_TEXT="[DEEP_SEARCH_DONE] task=${TASK_NAME} output=${OUTPUT} lines=${LINES} duration=${DURATION} status=$(jq -r '.status' "${RESULT_DIR}/latest-meta.json" 2>/dev/null)"
  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
    "http://localhost:${GATEWAY_PORT}/hooks/wake" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer ${HOOK_TOKEN}" \

Static analysis

No suspicious patterns detected.