Security audit

Codex Swarm

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned for Codex swarm coding, but it can automatically commit, push, merge to main, and run background agents without strong review gates.

Install only if you intentionally want autonomous Codex agents operating on a repository. Use a fork or protected branches, disable auto-merge unless explicitly needed, review diffs before anything reaches main, avoid sensitive task prompts, and enable external notifications only with trusted endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The manifest description includes broad trigger language such as 'parallel coding,' 'multi-agent work,' and 'batch spawning,' which can cause the skill to activate in situations beyond the user's specific intent. In a skill that orchestrates shell scripts, git operations, tmux sessions, and automated agents, accidental invocation expands exposure to potentially disruptive actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises webhook and Telegram notifications but does not warn users in the Markdown description that task metadata, status, or other information may be transmitted to external services. In the context of coding orchestration, those notifications could disclose repository names, branch names, task descriptions, or progress data outside the local environment.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This script performs privileged repository-changing actions automatically: it checks out main, pulls, merges multiple branches, may commit changes, and can push directly to origin/main without any explicit user confirmation or enforcement of review gates. In a multi-agent orchestration context, this is dangerous because it turns potentially untrusted or low-quality agent output into direct changes on the primary branch, increasing the risk of accidental code injection, broken integrations, or policy bypass at scale.

Missing User Warnings

High

Confidence: 99% confidence
Finding: On merge conflict, the script invokes `codex exec --full-auto` to resolve conflicts and then runs `git add . && git commit --no-edit`, allowing an autonomous model to modify and commit repository contents without scoped file restrictions or human review. This is especially risky here because conflict content may include adversarial code or instructions from parallel agent branches, and the automation can silently bless unsafe resolutions into the integration branch.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script automatically stages, commits, and pushes changes produced by an automated review loop without any explicit user approval, visibility, or policy gate. In a multi-agent coding/orchestration context, this can propagate incorrect, unsafe, or attacker-influenced code to the remote repository, especially because the review output is heuristically parsed and failures are suppressed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script launches an autonomous Codex agent in full-auto mode and embeds instructions to commit, push, and create a PR without any interactive confirmation at execution time. In a multi-agent orchestration skill, that means unreviewed or prompt-influenced changes can be propagated to the remote repository automatically, increasing the risk of unintended code changes, data leakage, or malicious modifications being published.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.