ClawHub
Back to skill

Security audit

qapten-codex

Security checks for vulnerabilities and agentic risk

Overview

This is a French Markdown guide for using Codex CLI, GitHub, and deployment tools; its risky commands are disclosed, user-run examples rather than hidden behavior.

Install only if you want a French guide for Codex CLI development and deployment. Review the commands before running them, avoid danger-full-access except in an isolated disposable environment, and use least-privilege GitHub, deployment, and SSH credentials.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Content
### Variables d'environnement (recommandées)

- `GH_TOKEN` — Personal Access Token GitHub (optionnel, sinon passer par `gh auth login`)

### Secrets à configurer (non stockés dans le skill)
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
cd /chemin/du/projet
codex exec --json --color never --skip-git-repo-check "Décris ce que tu veux faire ici..."
```

### Avec sandbox désactivé (si le sandbox n'est pas supporté)
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
⚠️ **Utilise cette option uniquement si tu sais ce que tu fais** — elle désactive l'isolation du sandbox.

```bash
codex exec --json --color never --sandbox danger-full-access --skip-git-repo-check "Ta tâche..."
```

> **Recommandation de sécurité** : n'utilise pas `--sandbox danger-full-access` sur des machines contenant des données sensibles. Privilégie un conteneur isolé pour les tâches à risque.
Confidence
95% confidence
Finding
This command combines external agent execution with `--sandbox danger-full-access`, explicitly disabling isolation while allowing the agent to read, modify, and potentially execute within the local environment. Even with a warning, documenting this as a ready-to-run example materially increases the chance of credential exposure, destructive file changes, or lateral impact on a host that contains sensitive data.

External Transmission

Medium
Category
Data Exfiltration
Content
3. **Déployer** :
   ```bash
   # Via API Coolify
   curl -X POST "https://<COOLIFY_URL>/api/v1/deploy" \
     -H "Authorization: Bearer <COOLIFY_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{"uuid":"<APP_UUID>","force":true}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The description is entirely in French and presents the skill as a general-purpose development, GitHub, and deployment guide rather than a region-specific or French-only tool. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation when no alternative language option or justification is provided.

Static analysis

No suspicious patterns detected.