Security audit

codexbox

Security checks for vulnerabilities and agentic risk

Overview

The skill serves its stated purpose, but automatic sandbox bypass combined with host Docker access warrants review before installation.

Use an isolated machine and dedicated Codex/SSH state because host Docker access can extend an agent's reach beyond its workspace. Review the installer and wrapper, select a reviewed image digest, set separate API/MCP tokens, and bind services to loopback. Enable scheduled jobs only with explicit scope and a stopping plan.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: codexbox description: "Install, configure, or run Codex through the codexbox wrapper, or connect to its HTTP, MCP, Telegram, or cron surfaces." homepage: https://github.com/psyb0t/docker-codexbox user-invocable: true metadata: { "openclaw": { "emoji": "🧑‍💻", "primaryEnv": "CODEXBOX_URL", "requires": { "bins": ["docker", "curl"] } } } --- # codexbox [OpenAI Codex CLI](https://github.com/openai/codex) inside an [aicodebox](https://github.com/psyb0t/docker-aicodebox) container, put on the network. codexbox is aicodebox's `codex` adapter — the HTTP/MCP/Telegram/cron surfaces are aicodebox's,

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
| `GET` | `/openai/v1/models` | model list from `CODEXBOX_AVAILABLE_MODELS` | | `POST` | `/mcp/` | MCP server, mounted only when `CODEXBOX_MCP_MODE=1` (see MCP mode) | `DELETE /files/{path}` removes a workspace file (no undo). Confirm the target path first and only remove files the current task created — see [Security & safety](#security--safety). `POST /run` body: `prompt` (required), `workspace`, `model`, `systemPrompt`, `appendSystemPrompt`, `jsonSchema`, `noContinue`, `resume`, `timeoutSeconds`, `thinking`, `noTools`, `toolsAllowlist`, `includeRaw`, `async`, `fireAndForget`. With `jsonSchema` set, the response adds `json`, `events`, `sessionId`, `usage`, `attempts` — codex has native `--output-schema` enforcement, so `jsonSchema` maps straight onto it (no self-correction retries needed, unlike adapters without native schema support).

Docker image referenced without tag or digest: 'docker run --rm'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The multiline command actually specifies psyb0t/codexbox:latest, so the detector's claim that no tag exists is inaccurate; however, the image is still not immutably pinned. A compromised or unexpectedly changed image could access the writable workspace, mounted Codex state, and supplied API credential, making mutable-image execution consequential here.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The complete API deployment command uses the mutable tag psyb0t/codexbox:latest rather than omitting an image tag. The underlying supply-chain concern remains: a substituted image would receive the API credential and writable workspace while running as a network service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
noContinue is ephemeral and leaves the workspace pin unchanged.

bash
curl -s http://localhost:8080/run \ --oauth2-bearer "$CODEXBOX_API_MODE_TOKEN" \ -H "Content-Type: application/json" \ -d '{"prompt": "say HELLO", "workspace": "/workspace"}'

Docker image referenced without tag or digest: 'docker run -d'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The API/MCP example supplies an image tag, but latest is mutable and does not establish immutable image identity. A compromised image could access the mounted workspace, upstream API credential, and both service tokens; configuring authentication does not protect against malicious container contents.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The Telegram command uses psyb0t/codexbox:latest, so this is a mutable-image issue rather than a missing-tag issue. An altered image could access the Telegram bot token, OpenAI credential, writable workspace, and persisted aicodebox configuration.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The cron deployment references the mutable latest tag, despite the static match reporting only docker run -d. Scheduled unattended execution increases the significance of an unexpected image change because the container receives an API credential and writable workspace without per-run human review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
Fire a one-off prompt from a script:

bash
curl -s http://localhost:8080/run \ -H "Authorization: Bearer $CODEXBOX_TOKEN" -H "Content-Type: application/json" \ -d '{"prompt": "list every TODO in /workspace", "workspace": "/workspace"}' | jq -r .text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.
Schema-constrained extraction:

bash
curl -s http://localhost:8080/run \ -H "Authorization: Bearer $CODEXBOX_TOKEN" -H "Content-Type: application/json" \ -d '{ "prompt": "extract the version + license from README.md",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.
Async run + poll:

bash
run_id=$(curl -s http://localhost:8080/run -H "Authorization: Bearer $CODEXBOX_TOKEN" \ -H "Content-Type: application/json" \ -d '{"prompt": "run the full test suite and summarize failures", "async": true}' | jq -r .runId)

Docker image referenced without tag or digest: 'docker run -d'.

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run --rm'.

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -it'.

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker pull psyb0t/codexbox:latest'.

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Although latest is an explicit tag, it is mutable and does not identify an immutable, reviewed image. If the publisher or registry is compromised, pulling and subsequently running a substituted image could expose mounted workspace files and Codex credentials; documented wrapper access to the host Docker daemon can further increase the impact. The installer-inspection advice does not establish the integrity of future image updates.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.