Back to skill

Security audit

Codex Conductor

Security checks across malware telemetry and agentic risk

Overview

The skill is a transparent software-delivery orchestration tool whose file writes, shell commands, and delegated-agent prompts are purpose-aligned, with review-worthy operational risks but no artifact-backed deception or exfiltration.

Install only if you want a workflow orchestrator that can create or update project documentation, run shell commands, and ask coding agents to make fixes. Use it in a version-controlled workspace, review diffs after scaffold and documentation steps, avoid feeding secrets into test output or failure logs, and treat the --no-enforce gate bypass as an audit exception.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly directs use of file reads, file writes, and shell execution via multiple Python scripts, but it does not declare or surface those capabilities as explicit permissions. This creates a transparency and consent problem: users may invoke the skill expecting advisory orchestration, while it actually drives workspace modification and command execution.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The scaffolding step instructs execution of a script that creates and updates AGENTS.md, docs, and orchestrator state files, but gives no explicit warning that it will modify the workspace. In a coding-agent context, this can lead to unintended overwrites, repository noise, or destructive changes if run in the wrong directory or against an existing project.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The change-impact workflow tells the user to run a script and then complete emitted TODOs in impacted docs, implying automated workspace modifications without a clear warning. In a brownfield or production-adjacent repo, such implicit edits can propagate inaccurate documentation changes or accidental writes beyond what the operator intended.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The packaging command writes a distributable artifact to disk but does not warn that new output files/directories will be created. While lower risk than broad workspace mutation, it can still surprise users, overwrite prior build artifacts, or leak packaged content into unintended locations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script exposes a --no-enforce flag that disables sequential and documentation-based gate precondition checks before changing gate state. In an orchestrator intended to provide strict stage gates and progress integrity, this enables users or downstream automation to mark gates as IN_PROGRESS or PASS without satisfying required prerequisites, undermining workflow trust and audit accuracy.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
openclaw gateway wake --text "Done: {gate} fix attempt {retry_num} complete | verify: docs/agent-handoff.md" --mode now
"""
    prompt_path.write_text(prompt, encoding="utf-8")
    return prompt_path


def execute_agent(agent_cmd_base: list[str], prompt_file: str):
Confidence
95% confidence
Finding
return prompt

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.