ClawHub
Back to skill

Security audit

Codex Native Scheduler

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently creates user-controlled native scheduled Codex jobs, with persistence and command execution that match its stated purpose.

Install this only if you intentionally want Codex tasks to run later or recur using your local Codex login and policy settings. Review each job's prompt, working directory, schedule, profile/config overrides, captured environment variables, and retention settings before creating it; prefer worktree mode for jobs that may write files and avoid capturing secrets unless necessary.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
stdout_path.open("w", encoding="utf-8") as stdout_handle,
                stderr_path.open("w", encoding="utf-8") as stderr_handle,
            ):
                process = subprocess.Popen(
                    command,
                    cwd=cwd,
                    env=environment,
Confidence
83% confidence
Finding
This code executes a command and environment derived from job configuration, including job["codex"]["command"], profile/config overrides, cwd, and a full environment mapping, with no visible validation or allowlisting. Although shell injection is mitigated by passing an argument list to Popen, this still permits arbitrary executable selection and environment-variable injection, which can execute attacker-controlled binaries or alter Codex/Python behavior if untrusted users can create or modify jobs.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill describes capabilities that can read environment variables, read and write files, and invoke shell commands, but it does not declare corresponding permissions. That creates a transparency and policy-enforcement gap: operators may approve or run the skill without understanding its effective access, and downstream tooling cannot reliably gate risky behavior.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: codex-native-scheduler
description: Schedule, inspect, retry, pause, resume, stop, and decommission unattended Codex CLI jobs through macOS launchd, Linux systemd user timers, or Windows Task Scheduler. Use when the user wants Codex to run later or recur without a resident daemon, or needs to manage jobs created by codex-schedule.
---

# Codex Native Scheduler
Confidence
88% confidence
Finding
This skill is explicitly designed to establish unattended, persistent scheduled execution via launchd, systemd user timers, or Windows Task Scheduler. Persistence is not inherently malicious here, but it is a real security-sensitive capability because it can cause commands to execute later, recur without active user presence, and survive beyond the initiating session, increasing the blast radius of any misconfiguration or prompt abuse.

Static analysis

No suspicious patterns detected.