ClawHub
Back to skill

Security audit

Codex Auth Session Refresh

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but needs Review because it handles live ChatGPT/Codex credentials, persists session data and backups, and relies on unaudited install-time scripts from a mutable remote repository.

Install only if you understand that this tool copies a live ChatGPT-derived token into Codex credentials and stores browser/session artifacts locally. Review the actual PowerShell scripts from the cloned repository before running them, prefer a pinned release or commit, protect and periodically delete browser-profile/backups/logs, and avoid enabling the scheduled task unless ongoing automatic credential refresh is truly needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 Β· Insecure Dependencies

Error
Location
scripts/package-lock.json:14
Finding

Security-Sensitive Dependency Is Resolved Through a Non-Default Package Mirror

Content
View full analysis
=18" } } ``` Related instructions from `SKILL.md:42-47`: ```powershell git clone https://github.com/zcz-user/codex-auth-session-refresh.git cd codex-auth-session-refresh npm install .\login-profile.ps1 # Login ChatGPT β†’ press Enter .\status.ps1 # Check Codex auth state ``` ### Technical Analysis The lockfile resolves `playwright-core` through `registry.npmmirror.com` rather than the default npm registry. This dependency executes browser automation in a process that handles an authenticated ChatGPT browser profile and writes Codex credentials. The integrity hash provides protection only against an archive differing from the version recorded in the current lockfile. It does not establish trust in the repository or protect users who clone a later mutable revision containing both a changed lockfile and a corresponding malicious integrity value. The installation workflow also directs users to clone a mutable GitHub repository and execute PowerShell tools that are not included in the audited artifact. Consequently, the behavior of `login-profile.ps1`, `status.ps1`, and the other documented PowerShell entry points could not be verified. Although `package-lock.json` pins the currently resolved archive to version `1.60.0`, `packag ...[truncated 1621 chars]
Remediation
View remediation

T09 Β· Insecure Skill Coding Practices

Error
Location
scripts/refresh-codex-auth.js:107
Finding

Plaintext Authentication Backups and Persistent Browser Sessions Lack Enforced Protection and Retention

Content
View full analysis
Remediation
View remediation

T09 Β· Insecure Skill Coding Practices

Warning
Location
scripts/refresh-codex-auth.js:27
Finding

Logging Helper Writes Events to Disk Before Removing Token Fields

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This skill is explicitly designed to extract a live ChatGPT access token from a browser session and place it into another application's auth store, which is credential access behavior. Even if presented as a convenience feature, bearer-token extraction and persistence materially increase the risk of account misuse, token theft, session hijacking, or unintended privilege transfer if the host is compromised or the workflow is misused.

Content

Scanner excerpt Β· SKILL.md (reported line 63)May include surrounding context.

md
| Command | What it does |
|---------|-------------|
| `login-profile.ps1` | First login / re-login into ChatGPT (for Codex) |
| `run-refresh.ps1` | Refresh Codex's access token now |
| `status.ps1` | Check Codex auth.json status |
| `install-scheduled-task.ps1` | Auto-refresh Codex auth every N hours |
| `create-desktop-toolbox.ps1` | Desktop shortcuts for Codex auth management |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt Β· references/SECURITY.md (reported line 16)May include surrounding context.

md
| `browser-profile/` | ChatGPT login cookies & session state |
| `logs/` | Refresh logs (tokens are masked, but metadata is sensitive) |
| `backups/` | Historical copies of your `auth.json` |
| `auth.json` | Raw access tokens (resides in `~/.codex/`, not in repo) |
| `*.log` | Any log files |
| `.env` | Environment configuration |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt Β· references/SECURITY.md (reported line 26)May include surrounding context.

md
1. **Sign out from all ChatGPT sessions**
   - Go to https://chatgpt.com β†’ Settings β†’ Security β†’ Sign out all devices
2. **Delete the browser profile** β€” `rm -rf browser-profile/`
3. **Delete all backups** β€” `rm -rf backups/`
4. **Regenerate credentials** β€” Change your ChatGPT password
5. **Rotate any API keys** that may have shared the same environment

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt Β· references/SECURITY.md (reported line 27)May include surrounding context.

md
1. **Sign out from all ChatGPT sessions**
   - Go to https://chatgpt.com β†’ Settings β†’ Security β†’ Sign out all devices
2. **Delete the browser profile** β€” `rm -rf browser-profile/`
3. **Delete all backups** β€” `rm -rf backups/`
4. **Regenerate credentials** β€” Change your ChatGPT password
5. **Rotate any API keys** that may have shared the same environment

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt Β· references/assets/header-dark.svg (reported line 53)May include surrounding context.

text
<!-- Subtitle -->
  <text x="520" y="125" font-family="system-ui, -apple-system, sans-serif" font-size="18" fill="#8b949e">Refresh your Codex CLI auth from ChatGPT β€” automagically</text>

  <!-- Description boxes -->
  <g transform="translate(520, 145)">
    <rect x="0" y="0" width="180" height="40" rx="20" fill="#1f6feb"/>
    <text x="90" y="25" font-family="system-ui" font-size="14" fill="white" text-anchor="middle" font-weight="600">πŸ” Secure</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt Β· references/assets/header-dark.svg (reported line 14)May include surrounding context.

text
</linearGradient>
  </defs>

  <!-- Background -->
  <rect width="1280" height="220" fill="url(#bg)" rx="12"/>

  <!-- Accent line -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt Β· references/assets/header-light.svg (reported line 14)May include surrounding context.

text
</linearGradient>
  </defs>

  <!-- Background -->
  <rect width="1280" height="220" fill="url(#bg)" rx="12"/>

  <!-- Accent line -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt Β· references/assets/header-light.svg (reported line 53)May include surrounding context.

text
<!-- Subtitle -->
  <text x="520" y="125" font-family="system-ui, -apple-system, sans-serif" font-size="18" fill="#495057">Refresh your Codex CLI auth from ChatGPT β€” automagically</text>

  <!-- Description boxes -->
  <g transform="translate(520, 145)">
    <rect x="0" y="0" width="180" height="40" rx="20" fill="#4285F4"/>
    <text x="90" y="25" font-family="system-ui" font-size="14" fill="white" text-anchor="middle" font-weight="600">πŸ” Secure</text>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill declares no explicit tool scope or permissions boundaries even though it clearly operates on local authentication state and environment-specific resources. In a credential-handling skill, missing scope declarations increase the chance that an agent or user invokes it without understanding that it can access and modify sensitive local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not present a clear upfront warning that it extracts a ChatGPT session access token from a browser session and writes it into Codex credential storage. Because this changes local authentication state and handles bearer-token material, users may unknowingly expose or overwrite credentials with security consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly describes extracting a ChatGPT browser session token and writing it into Codex's auth.json, but it does not prominently warn that this token is a sensitive credential that can grant account access if exposed. In a tool specifically designed to copy session-derived authentication material, insufficient warning and consent language increases the risk of accidental credential leakage, unsafe storage, or misuse by users who may not understand the security implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The document includes Chinese-language text alongside English, such as 適用於 Codex and later Chinese-only phrasing, but it does not tell users that bilingual content will be used or offer a language preference. Under the language/locale policy, forcing a language or locale without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Line 38 contains Chinese text only, which may impose a language requirement on users who do not read that language. Because no locale justification or user language choice is provided, this is a policy concern for language accessibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file presents Chinese as the active language and points to English via a separate link, but the natural-language content of this file itself is fixed to one locale. Under the stated policy, forcing a specific language without user opt-in can be a locale policy violation unless the constraint is clearly justified or the user is offered an in-context choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific locale or platform preference without user choice. The phrase "Windows-first" is user-facing text that signals a platform bias, and this file does not provide any justification or opt-in context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency version is specified with a caret range (^1.53.0), which allows newer minor/patch releases to be installed over time. This can introduce supply-chain risk and reduce build reproducibility, especially for a security-sensitive skill that automates browser-based authentication and handles auth session material.

Content

Scanner excerpt Β· scripts/package.json (reported line 13)May include surrounding context.

json
"refresh:headless": "node scripts/refresh-codex-auth.js"
  },
  "dependencies": {
    "playwright-core": "^1.53.0"
  }
}

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/refresh-codex-auth.js:77