ClawHub
Back to skill

Security audit

Codex Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Codex background-session helper, but it gives high-impact autonomous execution and prompt-approval instructions without enough safeguards.

Use this only for trusted, explicit long-running coding tasks. Do not pass untrusted prompt text into the shown shell command, inspect any interactive prompt before submitting input, avoid blind approvals, and run it only in repositories where full-auto Codex changes are acceptable or sandboxed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding
Shell Command Injection Through Unsafely Interpolated Prompt<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash bash pty:true workdir:<target_dir> background:true command:"codex exec --full-auto '<PROMPT>'" ``` ### Technical Analysis The workflow instructs the orchestrator to interpolate `<PROMPT>` directly into a shell command enclosed by single quotes. No escaping, validation, or structured argument handling is specified. If prompt content is obtained from an untrusted or partially trusted source, an embedded single quote can terminate the intended quoted argument. Subsequent shell metacharacters can then be interpreted as command syntax rather than prompt text. This permits arbitrary command injection under the account running the orchestrator. The use of `--full-auto` further increases the potential consequences because the launched Codex process is configured for autonomous operation, although exploitation of the shell interpolation flaw occurs before Codex processes the prompt. ### Attack Path 1. An attacker supplies or influences task text that will be substituted for `<PROMPT>`. 2. The malicious text includes a single quote that closes the surrounding shell quote. 3. The text appends shell syntax and an attacker-selected command. 4. The orchestrator constructs and launches the resulting command through `bash`. 5. The shell interprets the appended content as executable syntax. 6. The injected command runs with the filesystem access, environment variables, and operating-system privileges of the user running the orchestration skill. ### Impact Assessment Successful exploitation can provide arbitrary command execution with the invoking user's privileges. Depending on that account's permissions and environment, an attacker could read or modify accessible project files, destroy data, access credentials or tokens exposed through files or environment variables, alter source code, and invoke a ...[truncated 214 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not concatenate prompt content into a shell command string. - Invoke Codex through a structured process API that accepts an executable and argument array, ensuring the prompt is passed as one literal argument without shell interpretation. - Alternatively, provide the prompt through standard input or a securely created file with restrictive permissions. - If shell execution is unavoidable, apply a proven shell-escaping routine to every dynamic argument rather than relying on manual quoting. - Validate and constrain the target working directory separately, preferably by resolving it to an approved absolute path. - Add tests covering prompts containing single quotes, command separators, substitutions, newlines, and other shell metacharacters. - Consider avoiding `--full-auto` for untrusted tasks or running the process in a sandbox with minimal filesystem, network, credential, and operating-system permissions. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description is broadly framed as a general-purpose orchestration capability without clear activation boundaries, which increases the chance it will be invoked in contexts where background process control is unnecessary or risky. Because the skill can launch fully autonomous coding sessions and manage their execution, ambiguous triggering expands the attack surface and can enable unintended automation over sensitive repositories or environments.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the operator to send approval input like 'y' or Enter and to kill sessions, but it provides no safety checks, no requirement to inspect the prompt contents, and no warning that these actions may approve destructive operations or terminate important work. In this context, blindly answering interactive prompts in a full-auto coding session could authorize code changes, command execution, dependency installation, or other sensitive actions without informed review.

Static analysis

No suspicious patterns detected.