ClawHub
Back to skill

Security audit

codex-export

Security checks across malware telemetry and agentic risk

Overview

This skill appears intended to export Codex chat transcripts, but it handles sensitive session history with under-scoped disclosure and invocation wording.

Install only if you intentionally want a tool that reads past Codex session files and writes transcript exports. Treat exported Markdown as sensitive, review and redact it before sharing, and prefer explicit export commands or brief/redacted output when possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs the agent to read from `~/.codex/sessions/**/*.jsonl` and write Markdown output files, but the manifest does not declare corresponding permissions. Undeclared file read/write capability creates a transparency and policy gap: users and enforcement systems may not realize the skill can access potentially sensitive session data and persist it elsewhere.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description says to use the skill when the user asks to export, save, share, or review a past chat, session, or transcript, which is broad enough to match many generic requests. That increases the chance of accidental invocation in contexts where the user did not intend filesystem export, potentially causing unnecessary access to prior session data or creation of transcript files containing sensitive content.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explains how to export full transcripts and notes that tool call outputs are included by default, but it does not prominently warn that exports may contain sensitive conversation history, environment-derived data, or tool outputs. In this context, that omission matters because the skill is specifically designed to extract historical sessions and write them to a shareable Markdown file, increasing disclosure risk if users export or share data without realizing what is included.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.