Codex Hook

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:17 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed Codex task-automation tool, but it can autonomously modify repositories, relaunch agents, send task data externally, and merge pull requests with weak safety gates.

Install only if you intentionally want an autonomous coding workflow that can write files, run Codex with broad approvals, manage tmux sessions, use GitHub credentials, and optionally send task details to messaging/webhook services. Avoid using it on sensitive repositories unless auto-merge and auto-retry are disabled or heavily supervised, tokens are tightly scoped, and prompt/workspace inputs are trusted.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/task-dispatcher.sh:141

Finding

Shell Command Injection Through Task Prompts and Workspace Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto-merge.sh:96

Finding

Automatic Merge Fails Open When CI or Review Controls Are Missing

Content

View full analysis

/dev/null || echo "") if [[ -z "$checks" ]]; then print_msg "$YELLOW" "⚠️ 无 CI 检查" return 0 fi # 检查是否有失败的检查 if echo "$checks" | grep -qE "(FAILURE|FAILED|Error)"; then print_msg "$RED" "❌ CI 检查失败" echo "$checks" | grep -E "(FAILURE|FAILED|Error)" return 1 fi print_msg "$GREEN" "✅ CI 全部通过" return 0 ``` ```bash # 获取 PR 差异 local diff diff=$(gh pr diff "$pr_num" --stat 2>/dev/null || echo "") # 这里可以调用多个模型审查 # 1. Codex 审查 # 2. Claude 审查 # 3. Gemini 审查 # 简化版：记录审查状态 $REGISTRY update "$pr_num" "checks" '{"code_review": "pending"}' print_msg "$GREEN" "✅ 审查完成" return 0 ``` ```bash # 3. 执行合并 print_msg "$YELLOW" "📋 步骤 3/3: 合并 PR..." if gh pr merge "$pr_num" --squash --delete-branch 2>&1; then $REGISTRY complete "$task_id" "$pr_num" $REGISTRY log "$task_id" "PR merged: #$pr_num" "info" print_msg "$GREEN" "✅ 合并完成！" return 0 else print_msg "$RED" "❌ 合并失败" return 1 fi ``` ### Technical Analysis The CI check fails open in several cases: - No CI output is treated as successful. - Failure to query checks is converted into an empty string and treated as successful. - The implementation only searches for selected failure words. - Pending, queued, cancelled, skipped, timed-out, or unknown states are not rejected. The review function does not review the diff. It only requests diff statistics, writes a string representing a pending review, prints that review is complete, and returns success. It also calls the registry update using the PR number as though it were a task ID, so the recorded state may not update the intended task. The resulting flow can proceed directly to `gh pr merge` without confirmed successful CI or meaningful approval. ## ...[truncated 980 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/task-execute.sh:24

Finding

Path Traversal Allows Unauthorized Agent Memory Access

Content

View full analysis

/dev/null 2>&1 acpx --approve-all codex prompt "$prompt" > "/tmp/codex-results/tasks/$task_id/output.log" 2>&1 & ``` ### Technical Analysis `project_name` is supplied by the caller and is directly inserted into: ```text $MEMORY_DIR/$project_name/context.md ``` No identifier validation, canonicalization, or containment check is performed. Traversal components such as `..` can therefore cause the resolved path to leave the intended project-specific directory, provided the resulting path ends in an accessible `context.md`. The selected file is read and embedded in a Codex prompt. Codex is then invoked using `--approve-all`, increasing the significance of unauthorized or attacker-selected context because that content can affect an autonomously authorized task. Reading persistent OpenClaw memory is not necessary for basic task execution and should require explicit, scoped authorization. ### Attack Path 1. An attacker supplies a crafted project name containing traversal components. 2. The script constructs a path under `MEMORY_DIR` without canonicalization. 3. The operating system resolves the traversal and selects another accessible `context.md`. 4. The script reads that file. 5. Its contents are embedded into the task prompt. 6. T ...[truncated 695 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:202

Finding

Unsafe Export of All Secrets from a Shared Environment File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task-monitor.sh:308

Finding

Predictable Temporary File Enables Local Symlink Clobbering

Content

View full analysis

/tmp/registry_tmp.json && mv /tmp/registry_tmp.json "$REGISTRY_FILE" ``` ### Technical Analysis The monitor writes registry output to the globally predictable path `/tmp/registry_tmp.json`. The shell opens the path for truncation before `jq` executes. No use of `mktemp`, no ownership validation, and no symlink protection are present. On a multi-user system, another local process can create that path as a symbolic link to a file writable by the Skill user. The redirection then truncates or overwrites the symlink target. Multiple monitor instances can also race over the same temporary path. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/registry_tmp.json`. 2. The attacker creates it as a symbolic link to another file writable by the Skill user. 3. A monitored task times out or fails and enters the retry path. 4. Shell redirection opens and truncates the symlink target. 5. If `jq` succeeds, `mv` may also replace registry state with attacker-influenced or raced content. ### Impact Assessment Exploitation can overwrite or truncate files writable by the account running the Skill. It can also corrupt the task registry, causing: - Lost or incorrect task status. - Unexpected retries. - Incorrect completion or merge decisions. - Denial of service for task orchestration. The flaw does not directly bypass operating-system file permissions; its scope is the Skill user's writable files. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/task-registry.sh:120

Finding

Unsafe JSON Construction and Unlocked Registry Updates

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (64)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/auto-merge.sh (reported line 10)May include surrounding context.

sh

#!/bin/bash
# auto-merge.sh - 自动 PR 创建、CI 检查、代码审查、自动合并

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REGISTRY="$SCRIPT_DIR/task-registry.sh"

# 配置
GITHUB_TOKEN="${GITHUB_TOKEN:-}"
REPO_DIR="${REPO_DIR:-$HOME/projects}"
MAX_RETRIES="${MAX_RETRIES:-3}"

# 颜色
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

print_msg() { echo -e "${1}${2}${NC}"; }

# 检查依赖
check_deps() {
    local missing=()
    
    if ! command -v gh &>/dev/null; then
        missing+=("gh CLI")
    fi
    
    if ! command -v jq &>/dev/null; then
        missing+=("jq")
    fi
    
    if [[ ${#missing[@]} -gt 0 ]]; then
        print_msg "$RED" "缺少依赖: ${missing[*]}"
        return 1
    fi
    
    return 0
}

#

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The finding suggests additional context-reading, source copying, asynchronous external session launching, and undocumented commands beyond the stated purpose. Even where some details are inferred from surrounding docs, undocumented expansion of capability reduces transparency and can expose local project data or create unattended execution paths.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The documented pattern export $(cat ~/.openclaw/.env | xargs) loads secrets from a plaintext file into the shell environment, where they may be exposed through process inspection, shell history patterns, or accidental logging by child processes. In this skill, those credentials are then used for outbound notifications, increasing the blast radius if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

bash

# 方式一：加载环境变量后启动监控
export $(cat ~/.openclaw/.env | xargs) && codex-tasks monitor-start 60 &

# 方式二：直接指定间隔
codex-tasks monitor-start 60 &

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

Recommending storage of bot tokens and webhook URLs in ~/.openclaw/.env creates a plaintext secret repository without any documented file-permission or secret-management guidance. If the host is shared, backed up insecurely, or inspected by other tools, these credentials can be harvested and abused for impersonation or data exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

推荐将配置写入 ~/.openclaw/.env：

bash

# ~/.openclaw/.env
TELEGRAM_BOT_TOKEN="your-bot-token"
TELEGRAM_CHAT_ID="your-chat-id"
TELEGRAM_TOPIC_ID="123456"  # 可选，Forum 话题 ID

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Loading .env secrets directly into the process environment before starting background monitoring can expose those credentials to long-lived child processes and any subprocesses the monitor launches. Because the monitor may run continuously and interact with external services, credential lifetime and exposure are increased.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

启动监控时加载：

bash

export $(cat ~/.openclaw/.env | xargs) && codex-tasks monitor-start

方式二：环境变量

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The recovery path launches codex --sandbox workspace-write --full-auto exec and then injects prompt content from /tmp/codex-results/tasks/$task_id/prompt.txt into the session. This creates an autonomous execution path with write access based on potentially mutable local files and task registry data, which can be abused to execute unintended or malicious actions in the workspace.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The webhook sender posts arbitrary task messages and timestamps to any URL provided in WEBHOOK_URL, with no allowlist, confirmation, or data classification guardrails. In an agent/task-execution context, this can leak task IDs, names, outputs, and error details to attacker-controlled infrastructure if the environment variable or invocation is influenced by an untrusted party.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script invokes acpx --approve-all codex prompt, which grants blanket approval to an autonomous code-modifying agent without any approval gate, scope restriction, or confirmation. In this skill context, the tool is explicitly used to change project files, so a malicious task description or poisoned project context can cause unintended file modification, dependency installation, secret access, or destructive actions with the user's permissions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell-capable behavior but declares no explicit tool scope or permission boundary. That makes repository mutation, process control, filesystem writes, and network-capable helper scripts possible without clear least-privilege constraints, increasing the chance of unsafe execution in agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation advertises automatic PR merge without a prominent warning that it changes repository state and may integrate unreviewed code. In an agent skill context, this is risky because automation may merge generated changes into protected or production-bound branches with minimal oversight.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to store bot tokens and webhooks and send notifications externally, but it does not warn about credential sensitivity, secret storage hygiene, or outbound data exposure. This can lead to accidental token leakage, misuse of webhooks, or disclosure of task and repository metadata to third parties.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes a wide set of generic command triggers such as execute, start, stop, monitor, and report without any visible scoping, confirmation requirements, or activation constraints. In an automation/task-execution skill, broad triggers increase the chance of unintended invocation, command collision with other skills, or misuse of powerful task-control behaviors through ambiguous user input.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script’s implemented behavior materially exceeds the stated skill scope by creating, merging, and deleting GitHub branches and pull requests. In an agent skill context, capability mismatch is dangerous because operators may authorize a seemingly simple task-monitoring tool that can actually perform destructive repository actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code review function reports success even though it performs no substantive review and merely marks review status as pending in the registry. This can create a false assurance gate before automatic merge, allowing unsafe or malicious code to be merged without actual review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script performs gh pr merge --squash --delete-branch without confirmation, approval validation, or a safety interlock. In an automated agent workflow, this can directly cause unintended merges, loss of branch history, and production-impacting code changes if triggered on the wrong PR or repository.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script transmits task completion data to Telegram and consumes Telegram bot credentials even though that external notification capability is not clearly justified by the declared skill purpose. Hidden or under-disclosed outbound communication increases the risk of unintended data leakage from agent execution contexts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The hardcoded Telegram API endpoint confirms that the script communicates with an external third-party service. In the context of a repository automation skill, that outbound path expands the attack surface and creates a potential leakage channel for internal workflow information.

Content

Scanner excerpt · scripts/auto-merge.sh (reported line 240)May include surrounding context.

sh

# 发送消息
    local response
    response=$(curl -s -X POST "https://api.telegram.org/bot$tg_token/sendMessage" \
        -d "chat_id=$tg_chat_id" \
        -d "text=$message" \
        -d "parse_mode=Markdown" 2>&1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The hardcoded Telegram API endpoint confirms that the script communicates with an external third-party service. In the context of a repository automation skill, that outbound path expands the attack surface and creates a potential leakage channel for internal workflow information.

Content

Scanner excerpt · scripts/auto-merge.sh (reported line 240)May include surrounding context.

sh

# 发送消息
    local response
    response=$(curl -s -X POST "https://api.telegram.org/bot$tg_token/sendMessage" \
        -d "chat_id=$tg_chat_id" \
        -d "text=$message" \
        -d "parse_mode=Markdown" 2>&1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Task data is sent to an external Telegram service without clear user-facing disclosure in the main workflow, which can leak internal task names, statuses, and PR references outside the local environment. In agent skills, undisclosed network transmission is especially risky because it may occur automatically after repository operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The header advertises periodic checking and Telegram reporting, but the implementation also changes task state and restarts execution sessions. This mismatch is security-relevant because reviewers or operators may grant trust or permissions appropriate for passive monitoring while the script actually performs active control-plane actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.