Security audit

Codex Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Codex background-session helper, but it gives high-impact autonomous execution and prompt-approval instructions without enough safeguards.

Use this only for trusted, explicit long-running coding tasks. Do not pass untrusted prompt text into the shown shell command, inspect any interactive prompt before submitting input, avoid blind approvals, and run it only in repositories where full-auto Codex changes are acceptable or sandboxed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:15
Finding: Shell Command Injection Through Unsafely Interpolated Prompt
Content: View full analysis
background:true command:"codex exec --full-auto ''" ``` ### Technical Analysis The workflow instructs the orchestrator to interpolate `` directly into a shell command enclosed by single quotes. No escaping, validation, or structured argument handling is specified. If prompt content is obtained from an untrusted or partially trusted source, an embedded single quote can terminate the intended quoted argument. Subsequent shell metacharacters can then be interpreted as command syntax rather than prompt text. This permits arbitrary command injection under the account running the orchestrator. The use of `--full-auto` further increases the potential consequences because the launched Codex process is configured for autonomous operation, although exploitation of the shell interpolation flaw occurs before Codex processes the prompt. ### Attack Path 1. An attacker supplies or influences task text that will be substituted for ``. 2. The malicious text includes a single quote that closes the surrounding shell quote. 3. The text appends shell syntax and an attacker-selected command. 4. The orchestrator constructs and launches the resulting command through `bash`. 5. The shell interprets the appended content as executable syntax. 6. The injected command runs with the filesystem access, environment variables, and operating-system privileges of the user running the orchestration skill. ### Impact Assessment Successful exploitation can provide arbitrary command execution with the invoking user's privileges. Depending on that account's permissions and environment, an attacker could read or modify accessible project files, destroy data, access credentials or tokens exposed through files or environment variables, alter source code, and invoke a ...[truncated 214 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description is broadly framed as a general-purpose orchestration capability without clear activation boundaries, which increases the chance it will be invoked in contexts where background process control is unnecessary or risky. Because the skill can launch fully autonomous coding sessions and manage their execution, ambiguous triggering expands the attack surface and can enable unintended automation over sensitive repositories or environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the operator to send approval input like 'y' or Enter and to kill sessions, but it provides no safety checks, no requirement to inspect the prompt contents, and no warning that these actions may approve destructive operations or terminate important work. In this context, blindly answering interactive prompts in a full-auto coding session could authorize code changes, command execution, dependency installation, or other sensitive actions without informed review.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.