ClawHub
Back to skill

Security audit

Codex Usage Widget

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local-only Codex usage widget with disclosed file access and no evidence of upload, credential use, or unrelated behavior.

Install only if you are comfortable with a desktop widget repeatedly reading local Codex usage metadata and thread titles from ~/.codex. I found no evidence of network upload or credential access. Note that it installs/removes a fixed Übersicht widget folder and writes a local usage cache under ~/.codex; index.jsx also appears to have a malformed command string that may affect functionality rather than security.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the user to run local shell scripts and a Python validator, and it writes into a user widget directory, but it does not declare any explicit tool scope or permissions boundary. That mismatch is a real security issue because consumers and automated systems cannot reliably tell that the skill requires shell, file read, and file write capabilities, increasing the chance of over-broad execution without informed consent or policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The output uses fixed Chinese labels ["一", "二", "三", "四", "五", "六", "日"] for weekday names, which imposes a specific language in user-facing output. The file provides no opt-in, locale selection, or documentation justifying a Chinese-only interface, so this is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code path independently formats weekday labels in Chinese for the fallback daily buckets output. Because the script can emit these labels to users and does not offer language selection or explain a region-specific requirement, it violates the language/locale policy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The comment on L002 describes the behavior as limited to reading local sqlite and rollout files only, with no other action implied. However, L006-L007 define a shell command that launches a separate Python program, which is a broader behavior than the comment states and shifts the actual data-access logic outside this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script recursively deletes the installation directory with rm -rf and only reports the action after it has already occurred. There is no confirmation prompt, pre-action warning, or explanatory comment/docstring in the file disclosing this destructive behavior to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.