codex-cn-bridge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

The skill’s stated purpose is coherent, but installation relies on mutable, unreviewed remote code that will handle API keys, Codex configuration, and model traffic.

Review the upstream repository and installer before installing, preferably use a pinned commit or release with a verified digest, and only use this bridge with prompts and code you are comfortable sending to the configured third-party model providers. Treat the configured API keys as sensitive credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:20

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–33
Vulnerability Type: Remote payload retrieval without version pinning or integrity verification
Risk Level: Medium

Vulnerable Code Snippet

bash

openclaw skills install codex-cn-bridge

/codex-cn-bridge install

Alternative installation path:

bash

git clone https://github.com/luckKiven/codex-cn-bridge.git

cp -r codex-cn-bridge ~/.openclaw/workspace/skills/

Technical Analysis

The audited package contains only SKILL.md; the proxy implementation and supporting scripts described by the documentation are not included. Instead, users are instructed to run an installer that automatically downloads the complete implementation or clone the repository's mutable default branch.

Neither installation path pins the retrieved payload to an immutable commit or release, verifies a cryptographic checksum or signature, or otherwise validates the downloaded files before use. The effective code executed by users can therefore change after this Skill has been reviewed.

The absent implementation reportedly includes proxy.py, models.yaml, and start.bat. Because these files are fetched after installation, their behavior—including handling API keys, modifying Codex configuration, and processing prompts—cannot be verified from the audited artifact.

Attack Path

1. An attacker compromises the upstream repository, package registry entry, maintainer account, default branch, or remote installation infrastructure.
2. The attacker modifies the remotely hosted installer or proxy implementation.
3. A user follows SKILL.md and invokes /codex-cn-bridge install, or clones the mutable repository without specifying a trusted commit.
4. The altered implementation is downloaded without signature or checksum validation.
5. The user configures provider API keys and starts the downloaded proxy.
6. The malicious payload executes locally and can access data made available to the bridge, ...[truncated 1011 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the complete proxy implementation and all startup or configuration scripts directly in the reviewed Skill package.
2. If remote retrieval is necessary, pin every download to an immutable release artifact or exact Git commit rather than a mutable branch.
3. Publish SHA-256 or stronger hashes for all downloaded artifacts and verify them before extraction or execution.
4. Add cryptographic release signing and validate signatures against a documented, trusted maintainer key.
5. Display every download URL, resolved version, and expected digest before installation, and require explicit user confirmation.
6. Fail closed if integrity or signature verification cannot be completed.
7. Avoid automatically executing newly downloaded files; separate retrieval, verification, inspection, and execution into distinct steps.
8. Include the fetched proxy.py, models.yaml, startup scripts, and installer logic in future security reviews.
9. Run the bridge with minimum user privileges and restrict its access to credential and configuration files that are strictly required.
10. Document repository ownership, release provenance, update behavior, and a secure rollback process.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash

cp ~/.codex/cn-bridge.env.example ~/.codex/cn-bridge.env
# 然后编辑 .env 文件填入真实 API Key

方式 1：.env 文件（推荐）

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly instructs users to route Codex requests to an external provider bridge and select non-default third-party models. This can expose prompts, code, and potentially sensitive workspace content to external services with different trust, logging, retention, and data handling policies than the user may expect.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

bash

# 使用编程专用模型
codex exec -c model="qwen-coder-plus" -c model_provider="cn-bridge" "写个函数"

# 使用最强模型
codex exec -c model="qwen3-max" -c model_provider="cn-bridge" "复杂任务"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This command again directs Codex interactions to an external model provider through the bridge, increasing the risk of unintended data exfiltration to third-party AI APIs. In the context of a coding assistant, prompts may contain proprietary source code, secrets, or internal business information, making external provider selection materially security-relevant.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

codex exec -c model="qwen-coder-plus" -c model_provider="cn-bridge" "写个函数"

使用最强模型

codex exec -c model="qwen3-max" -c model_provider="cn-bridge" "复杂任务"

text

---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content of the skill is consistently Chinese and does not provide an English alternative, user opt-in, or justification that the skill is region-specific only. This can violate language/locale policy because it effectively forces a specific language for usage and troubleshooting.

Content

No source excerpt is available for this finding.