ClawHub
Back to skill

Security audit

codex-export

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it exports local Codex session transcripts, but users should remember those transcripts may contain sensitive data.

Install only from a source you trust, avoid running the npx install command with elevated privileges, and review exported Markdown before sharing it because full exports can include prompts, workspace paths, tool calls, and tool outputs. Use --brief when you want to reduce sensitive detail.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:10
Finding

Execution of an Unpinned Third-Party Installer Package

Content
View full analysis

Vulnerability Details

File Location: README.md:10-13
Vulnerability Type: Supply-chain risk from executing a mutable package version
Risk Level: Medium

bash
## Install (as a Codex skill)

```bash
npx clawhub@latest install codex-export
text

### Technical Analysis

The documented installation procedure instructs users to execute `clawhub@latest` through `npx`. The `latest` tag is mutable and does not identify a specific, previously reviewed package version. Depending on local npm behavior and cache state, `npx` can download the package and execute its CLI code with the permissions of the installing user.

The project does not provide an exact package version, package-lock entry, integrity hash, or vendored installer that would allow users to verify the executed artifact. Consequently, the code run during installation may differ from the code reviewed during this audit. This is a supply-chain weakness rather than evidence that the current `clawhub` package is malicious.

### Attack Path

1. An attacker compromises the package publisher account, npm distribution path, or a future release associated with the `latest` tag.
2. The attacker publishes a modified package containing malicious CLI or lifecycle behavior.
3. A user follows the documented `npx clawhub@latest install codex-export` command.
4. `npx` retrieves the attacker-controlled version selected by the mutable `latest` tag.
5. The downloaded package executes with the invoking user's permissions.
6. The malicious package can access or modify resources available to that user before or while installing the Skill.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope could include user-readable files, project source code, environment variables, local application state, and writable configuration or executable files. The command does not inherently grant adm
...[truncated 294 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with an exact, reviewed version, such as clawhub@X.Y.Z.
  2. Document how users can verify the package checksum, provenance, or npm integrity metadata before execution.
  3. Regularly review the pinned release and update it through an explicit, security-reviewed change.
  4. Provide a manual installation alternative that copies reviewed Skill files without executing a remotely retrieved installer.
  5. Where practical, use a lockfile or another reproducible installation mechanism that records exact package versions and integrity values.
  6. Advise users not to run the installation command with administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to install the skill via npx clawhub@latest install codex-export, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. If the clawhub package or its distribution path were compromised, users following the documentation could execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill advertises and relies on reading from ~/.codex/sessions/**/*.jsonl and writing Markdown output, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization transparency gap: a caller or reviewer cannot easily tell that the skill accesses local session history and writes files, which is sensitive because transcripts may contain private prompts, tool output, filesystem paths, or secrets from prior sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code writes a full session export, including user messages, tool calls, tool outputs, workspace path, and metadata, to a user-specified markdown file. While it prints the destination after writing, there is no prior warning in code comments, docstring, or user-facing messaging that the export may contain sensitive data from the session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.