Codex Sub Agents 1

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:47 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent Codex CLI integration guide, but it normalizes autonomous coding-agent execution, global agent configuration changes, credential/profile reuse, and mutable third-party MCP package execution without enough guardrails.

Review this skill before installing if you use private repositories or sensitive screenshots. Prefer read-only or approval-gated Codex modes by default, avoid `--full-auto` and `--yolo` outside isolated trusted workspaces, review diffs before applying changes, redact secrets before sending images or logs, and pin any MCP server packages instead of running mutable `npx` commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:187

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 187
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

codex mcp add github -- npx @anthropic/mcp-server-github

Technical Analysis

The documented command uses npx to resolve and execute @anthropic/mcp-server-github without specifying an exact version or verifying package integrity. The package version selected from the registry can therefore change after the Skill has been reviewed.

Because the package is registered as an MCP server, its code executes locally under the permissions of the user running Codex and may receive access to tools, environment variables, repository content, or network resources made available to that process. Although the package name appears intentional and there is no evidence that its current contents are malicious, mutable dependency resolution creates a supply-chain exposure.

Attack Path

1. An attacker compromises the package, its publisher account, or the package-distribution path.
2. The attacker publishes a malicious or compromised version under the same package name.
3. A user follows the documented command without an explicit version.
4. npx resolves and executes the mutable package version from the registry.
5. The package starts as an MCP server under the invoking user's identity.
6. Malicious code accesses repository data, credentials, environment variables, filesystem resources, or network services available to the process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. The accessible scope depends on Codex sandboxing and process isolation, but it may include source repositories, local files, authentication material exposed through the environment, and network-accessible services. Integration as an MCP server can also expose data exchanged through MCP operations.

...[truncated 136 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed exact version, for example @anthropic/mcp-server-github@X.Y.Z.
• Install it through a lockfile-controlled dependency workflow rather than resolving a mutable version during execution.
• Verify package provenance, publisher identity, integrity hashes, and signatures where supported.
• Review package updates before changing the pinned version.
• Run the MCP server with minimum necessary filesystem, environment, tool, and network access.
• Avoid exposing unrelated credentials or sensitive environment variables to the MCP process.
• Document the expected package source and approved version so operators can verify them before installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

codex login

# Or use API key
printenv OPENAI_API_KEY | codex login --with-api-key

# Verify auth
codex login status

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This skill is built to route tasks to an external model/provider (codex exec) that can read files and execute actions locally. Delegating codebase content and task context to an external provider can expose sensitive source code or metadata, especially when invocation is easy and the tool has broad filesystem access.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Non-Interactive (Scripting)

bash

codex exec "fix the CI failure"                    # Run and exit
codex exec --full-auto "add input validation"      # Auto-approve workspace writes
codex exec --json "list all API endpoints"         # JSON output for parsing
codex exec -i screenshot.png "match this design"   # With image input

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

This example combines external model delegation with --full-auto, meaning sensitive repository content may be transmitted to a third-party model while also allowing autonomous local modification. That pairing increases both confidentiality and integrity risk compared with a purely advisory external model call.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Non-Interactive (Scripting)

bash

codex exec "fix the CI failure"                    # Run and exit
codex exec --full-auto "add input validation"      # Auto-approve workspace writes
codex exec --json "list all API endpoints"         # JSON output for parsing
codex exec -i screenshot.png "match this design"   # With image input

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Using codex exec --json still delegates repository-derived prompts and results to an external model/provider. The JSON mode may further encourage automation and downstream processing without adequate human review, amplifying the impact of incorrect or sensitive outputs.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash

codex exec "fix the CI failure"                    # Run and exit
codex exec --full-auto "add input validation"      # Auto-approve workspace writes
codex exec --json "list all API endpoints"         # JSON output for parsing
codex exec -i screenshot.png "match this design"   # With image input

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This example sends an image (screenshot.png) along with the prompt to an external model/provider, potentially disclosing visual sensitive information such as credentials, internal URLs, customer data, or proprietary UI designs. In a coding skill, image attachments materially expand the data-exposure surface.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

codex exec "fix the CI failure" # Run and exit codex exec --full-auto "add input validation" # Auto-approve workspace writes codex exec --json "list all API endpoints" # JSON output for parsing codex exec -i screenshot.png "match this design" # With image input

text

### Session Management

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Reviewing a PR against the main branch via codex exec sends code review context, and potentially substantial code diffs, to an external provider. For private repositories this can expose proprietary code or security-sensitive changes outside the primary environment.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

/review # Choose: branch, uncommitted, or specific commit

Non-interactive

codex exec "review the changes in this PR against main branch"

text

## Multi-Directory Projects

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 93% confidence

Finding

The skill instructs modification of ~/.codex/config.toml, a user-level agent configuration file outside any project workspace. Guidance that alters global config can persistently change agent capabilities, including network access and other security-relevant settings, affecting future sessions beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

Web Search

Enable in ~/.codex/config.toml:

toml

[features]

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

This example directs an external coding agent to autonomously fix CI failures with --full-auto, combining third-party model exposure with unsupervised modifications. CI-related context may also include build scripts, secrets references, or infrastructure assumptions that should not be broadly shared or changed automatically.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

Fix CI Failure

bash

codex exec --full-auto "The CI is failing on the lint step. Fix all ESLint errors."

Refactor Component

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Refactoring source files through codex exec delegates local code content and architectural context to an external provider. Even without --full-auto, this still creates a meaningful confidentiality risk for non-public codebases and may produce changes that users over-trust because they came from a specialized coding tool.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

Refactor Component

bash

codex exec --cd src/components "Refactor UserProfile.tsx to use React Query instead of useEffect for data fetching"

Implement Feature from Spec

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This workflow uploads both a design spec image and project code context to an external model/provider. That may expose proprietary product plans, UX assets, or internal implementation details together, raising confidentiality risk beyond a simple text prompt.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

Implement Feature from Spec

bash

codex exec -i spec.png --cd ~/projects/app "Implement this feature based on the design spec"

Code Review PR

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Security-focused review of a branch diff through an external provider can disclose vulnerability details, defensive code, or incident-related changes before release. The sensitive nature of security review content makes external delegation especially risky in this context.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

Code Review PR

bash

codex exec "Review the diff between main and feature/auth branch. Focus on security issues."

Troubleshooting

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · cli-reference.md (reported line 67)May include surrounding context.

md

| `/feedback` | Send logs to maintainers |
| `/init` | Generate AGENTS.md |
| `/logout` | Sign out |
| `/mcp` | List MCP tools |
| `/mention <path>` | Attach file |
| `/model` | Switch model |
| `/new` | Fresh conversation |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · cli-reference.md (reported line 93)May include surrounding context.

Config File

Location: ~/.codex/config.toml

toml

[model]

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is very broad (codex, code review, implement feature, coding agent, etc.) and overlaps with common developer requests. In an agent ecosystem this can cause accidental invocation of a powerful coding tool, increasing the chance that local execution, editing, or delegation happens when the user did not explicitly intend it.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The documented use of --full-auto explicitly enables auto-approved workspace writes by the coding agent. In the context of a skill designed to delegate coding work, that reduces human oversight and increases the likelihood of unintended or unsafe file modifications being made automatically.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Non-Interactive (Scripting)

bash

codex exec "fix the CI failure"                    # Run and exit
codex exec --full-auto "add input validation"      # Auto-approve workspace writes
codex exec --json "list all API endpoints"         # JSON output for parsing
codex exec -i screenshot.png "match this design"   # With image input

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill encourages creation of reusable prompts in ~/.codex/prompts/, a persistent user-level directory. Persistent prompt artifacts can influence future sessions and may embed unsafe automation steps, causing actions to recur outside the original context or after the user forgets they were installed.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

Custom Slash Commands

Create reusable prompts in ~/.codex/prompts/:

markdown

<!-- ~/.codex/prompts/pr.md -->

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends launching an MCP server via npx @anthropic/mcp-server-github without pinning a specific package version. That creates a supply-chain risk because future package changes or a compromised latest release could alter the behavior of the tool invoked by the agent at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly recommends running codex exec --full-auto for trusted repositories without a nearby warning that the command can autonomously edit files and execute coding actions with potentially broad effects. In the context of an agent integration skill, operators may copy this pattern directly into automation, increasing the chance of unintended code changes, unsafe command execution, or propagation of prompt-injected instructions from repository content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example AGENTS.md instruction operationalizes codex exec --full-auto --cd <project_path> "<task>" as the default behavior for coding tasks, which encourages autonomous execution without informing users that changes may be made immediately. Because this skill is specifically designed to delegate coding work to a CLI subagent, the omission is more dangerous than generic documentation: it can normalize unattended execution in real repositories and reduce human oversight over file modifications and command effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

codex apply <task_id> is described only as applying a cloud diff locally, without warning that it changes local files based on remotely generated output. In a coding-agent context, users may treat this as routine and apply unreviewed modifications, potentially introducing malicious or unsafe code into the workspace.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The documentation presents a 'No approval' operational mode alongside danger-full-access, enabling autonomous execution without human review. In the context of a delegated coding agent, this materially increases the chance that the agent will perform unsafe filesystem, process, or network actions without a checkpoint, especially if prompted by ambiguous or adversarial instructions.

Content

Scanner excerpt · cli-reference.md (reported line 30)May include surrounding context.

md

| `--sandbox, -s` | read-only, workspace-write, danger-full-access | Sandbox policy |
| `--ask-for-approval, -a` | untrusted, on-failure, on-request, never | Approval mode |
| `--full-auto` | boolean | workspace-write + approve on failure |
| `--yolo` | boolean | No approvals or sandbox (dangerous) |
| `--profile, -p` | string | Config profile name |
| `--oss` | boolean | Use local Ollama |
| `--search` | boolean | Enable web search |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference explicitly documents a --yolo mode that disables both sandboxing and approvals, yet only labels it as 'dangerous' without explaining that it permits unrestricted command execution and file modification. In an agent skill intended to delegate coding work, this can normalize unsafe operation and lead users or downstream agents to run with maximal privileges, increasing the risk of destructive local actions or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The /feedback command says it sends logs to maintainers but provides no privacy or sensitivity warning about what those logs may contain. Session logs in a coding tool may include prompts, file paths, code snippets, tokens, or operational metadata, so users could unintentionally transmit sensitive information externally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.