Codex: Finish the Task

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:38 AM UTC
• Version: 1.0.0

Overview

This skill transparently makes Codex run routine development tasks with fewer interruptions, and the artifacts do not show hidden, destructive, persistent, or data-exfiltrating behavior.

Install this only if you want Codex to work more autonomously on development tasks. Keep explicit review in place for deletion, publishing, production changes, credential use, spending money, or other irreversible actions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill advertises broad natural-language activation phrases like 'nao pare' and 'rode ate o final', which can plausibly appear in ordinary user requests and unintentionally trigger a higher-autonomy mode. Because this skill explicitly authorizes uninterrupted execution and reduced confirmation behavior, accidental activation materially changes the agent's risk posture.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default prompt instructs the agent to run tasks end to end without avoidable confirmations, but it does not define boundaries for when autonomy is appropriate or what safety-sensitive actions still require confirmation. This can cause the skill to be invoked in overly broad contexts, increasing the chance of unreviewed destructive commands, unintended side effects, or policy-sensitive actions being performed automatically.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly promotes autonomous execution for low-quota or uninterrupted runs but does not warn that confirmations will be reduced or specify retained safety checks. In security terms, this normalizes suppressed user verification, making it easier for risky operations to proceed without meaningful user awareness or consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Operating Mode

Execute the requested task end to end. Treat the user's latest prompt as permission to make routine choices, run commands, edit files, wait for output, and verify results without asking for avoidable confirmations.

## Rules

• Confidence: 90% confidence
• Finding: This section instructs the agent to treat the latest prompt as permission to make routine choices, run commands, edit files, and verify results 'without asking for avoidable confirmations.' In a security context, reducing confirmation prompts increases the chance that ambiguous requests, prompt-injected instructions, or mis-scoped tasks lead to unintended command execution or file modification.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Confirmation Policy

Proceed without asking when the action is normal for the task:

- reading files, searching the repo, inspecting logs, checking status
- installing local dependencies already required by the project

• Confidence: 88% confidence
• Finding: The confirmation policy broadly permits proceeding without asking for actions such as installing dependencies, running servers, editing files, and polling until completion whenever the action seems 'normal for the task.' That framing can be exploited by malicious instructions embedded in task context or simply misapplied in ambiguous situations, enabling unnecessary execution and persistent environment changes without an explicit user checkpoint.

Static analysis

No suspicious patterns detected.