Security audit

Codex Session History

Security checks across malware telemetry and agentic risk

Overview

This is a read-only local Codex session history tool, but its output can reveal private workspace paths and prompt snippets.

Install or run this only if you are comfortable with an agent reading local Codex session history under ~/.codex. Avoid sharing output from --details, --json, or --contains unless you have checked it for private paths, project names, and prompt content. I found no artifact-backed evidence of network exfiltration, file mutation, persistence, or credential access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs reading local files under ~/.codex, which is a file-read capability handling potentially sensitive data, yet it declares no explicit permissions or warning boundary. That mismatch can mislead users and downstream systems about the skill's access scope, increasing the chance of unintended disclosure of session metadata and message content.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The skill reads ~/.codex/history.jsonl even though the manifest only declares session_index.jsonl, sessions/, and archived_sessions/. That is an overreach of the declared data scope and can expose additional user prompt/history content not expected by the user or calling system. In a session-listing skill, undeclared access to broader history data increases privacy risk because it enriches output with content-derived titles from a separate file.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The code walks from cwd through all parent directories looking for .git markers, which accesses filesystem locations outside the declared Codex session storage. Although used to infer a project root, it expands the skill's read scope beyond what the description promises and can reveal repository names or parent path structure. The danger is limited because it only checks for .git existence, but it still violates least-privilege expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This skill is designed to enumerate local session history and can reveal sensitive information such as workspace paths, project names, session titles, and first user messages. Without an explicit privacy warning, users may invoke it without realizing it surfaces potentially confidential local history, which raises the risk of accidental data exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The details view prints project_path, cwd, session_file, and first_user_message directly, exposing local filesystem paths and potentially sensitive prompt content. Because this skill is specifically designed to inspect local Codex session history, the context makes the disclosure more dangerous: session histories frequently contain confidential project names, internal paths, and user-entered secrets or sensitive requests. There is no built-in warning, redaction, or opt-in confirmation before emitting this sensitive information.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.