Security audit

codex-export

Security checks across malware telemetry and agentic risk

Overview

This is a local Codex session export tool whose sensitive transcript access is disclosed and aligned with its purpose, but exported files should be reviewed before sharing.

Before installing or using this skill, assume exported transcripts may include confidential prompts, local paths, command output, and secrets. Use --brief and --redact for external sharing, narrow exports with --since/--until, --grep, or --interactive, and manually review generated files before sending them anywhere.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly performs environment access and reads/writes local files, but the metadata does not declare permissions or warn the operator about those capabilities. That creates a transparency and consent problem: an invoking agent or user may trigger filesystem export behavior without an explicit security boundary being documented.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes exporting and sharing Codex conversations, but it does not prominently warn that session logs can contain sensitive content such as secrets, personal data, file paths, internal prompts, or tool output. In this skill context, that omission is materially risky because the tool is specifically designed to extract past chats for review or sharing, which increases the chance of accidental disclosure even when optional redaction exists.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation description is broad enough to match common requests like 'save', 'share', or 'review a past chat', which increases the chance the skill is auto-selected in situations where the user did not specifically intend transcript export. Because this skill handles potentially sensitive session contents and writes them to files, over-broad routing can lead to unintended disclosure or persistence of sensitive data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill exports full Codex session data, and the notes indicate that tool call outputs are included by default. Without a prominent warning that transcripts may contain secrets, local paths, tokens, personal data, or other sensitive tool output, users may unintentionally create shareable files that leak confidential information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/codex-export-more.js:11