ClawHub
Back to skill

Security audit

codexbox

Security checks across malware telemetry and agentic risk

Overview

This skill openly documents a powerful Codex-over-network container, including its file and execution access, auth requirements, persistence, and destructive-operation risks.

Install only if you want Codex reachable through these networked or scheduled interfaces. Set API and MCP bearer tokens before exposing any port, prefer loopback or an authenticating proxy, avoid unauthenticated shared workspaces, review the remote installer before running it, and treat mounted Codex auth/session directories as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The line states a fixed behavior of returning a "Markdown→HTML rendered response back" for Telegram interactions, which imposes a specific output format on users. While this is not a severe issue, it is a natural-language policy concern because the skill does not indicate any user choice or opt-in for alternate response formatting.

Hidden Instructions

High
Category
Prompt Injection
Content
homepage: https://github.com/psyb0t/docker-codexbox
user-invocable: true
metadata:
  { "openclaw": { "emoji": "🧑‍💻", "primaryEnv": "CODEXBOX_URL", "requires": { "bins": ["docker", "curl"] } } }
---

# codexbox
Confidence
60% confidence
Finding
‍

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `GET` | `/openai/v1/models` | model list from `CODEXBOX_AVAILABLE_MODELS` |
| `POST` | `/mcp` | MCP server, mounted only when `CODEXBOX_MCP_MODE=1` (see MCP mode) |

`DELETE /files/{path}` removes a workspace file (no undo). Confirm the target path first and only remove files the current task created — see [Security & safety](#security--safety).

`POST /run` body: `prompt` (required), `workspace`, `model`, `systemPrompt`, `appendSystemPrompt`, `jsonSchema`, `noContinue`, `resume`, `timeoutSeconds`, `thinking`, `noTools`, `toolsAllowlist`, `includeRaw`, `async`, `fireAndForget`. With `jsonSchema` set, the response adds `json`, `events`, `sessionId`, `usage`, `attempts` — codex has native `--output-schema` enforcement, so `jsonSchema` maps straight onto it (no self-correction retries needed, unlike adapters without native schema support).
Confidence
80% confidence
Finding
DELETE /files/{path}`

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
## MCP mode

`CODEXBOX_MCP_MODE=1`. Exposes the aicodebox base's own MCP surface — file ops + prompt running as tools: `run_prompt`, `list_files`, `read_file`, `write_file`, `delete_file`. This is separate from codex's own MCP client/server support (`config.toml` `[mcp_servers.*]`, `codex mcp-server` stdio) — neither of those is wired up by codexbox.

Coexists with any foreground mode:
Confidence
80% confidence
Finding
tools:; description:; ‍

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.