codex-juxingyi-setup

• Outcome: Review
• Latest audit: Aug 7, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This setup skill is not malicious, but it should go through Review because it rewrites Codex configuration and can expose local Codex history and configuration to an agent without redaction or clear privacy gates.

Review before installing. Only run the context and session scripts if you are comfortable exposing Codex conversation history, working directories, project names, tool-call summaries, and possibly sensitive config values in terminal output. Back up and inspect ~/.codex/config.toml before running configure.sh, and avoid putting real API keys directly in shell commands that may be logged.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs execution of shell commands and scripts, but the manifest does not declare corresponding permissions or capabilities. This weakens user and platform visibility into what the skill can do, increasing the risk of unexpected command execution during installation and configuration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose focuses on installing/configuring Codex and letting an agent perceive status, but the documented behavior extends into reading full Codex config, enumerating session indexes, and accessing conversation history and project metadata. That broader data-access surface can expose sensitive prompts, code context, file paths, and workflow details beyond what many users would reasonably expect from the description.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that running the context script gives the agent access to session lists, user messages, and conversation summaries. That creates a real privacy and data-minimization risk because prior prompts, responses, project paths, and tool-use details may contain secrets or sensitive business data, and the document provides no warning, consent model, or scoping limitation.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The README shows API key usage examples, including inline environment-variable assignment, but does not warn that credentials are sensitive or advise on secure handling. While documentation examples alone are not code execution, they can normalize unsafe practices such as leaking secrets into shell history, logs, screenshots, or CI output.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes agent context features that read config, session lists, full session details, active projects, and working directories, but it does not present an explicit privacy warning to users. Without clear notice, users may invoke the skill without understanding that recent Codex conversations and project metadata can be surfaced to the agent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prints the full Codex configuration file directly, which can expose API endpoints, tokens, trust settings, project paths, and other sensitive local state. In the context of a skill explicitly designed to aggregate context for agent consumption, this creates a clear data-exfiltration risk because recent session content and configuration are centralized and made easy to read or forward.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The connectivity check makes an outbound request to the configured service endpoint without an explicit warning or user confirmation. While limited in scope, it can leak the existence of the local environment, trigger unexpected network activity, and contact potentially sensitive or internal endpoints defined in the user's configuration.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script can print full session content, tool-call arguments/results, working directory, and other metadata directly from local Codex history with no privacy warning, redaction, or confirmation step. In this skill’s context, the data is likely to include prompts, secrets, file paths, and operational details, so accidental disclosure via terminal history, screen sharing, logs, or copied output is a realistic confidentiality risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script modifies the user's Codex configuration file in place and removes matching settings before rewriting it, but it does so without an explicit confirmation prompt or dry-run step. In a setup skill that reconfigures network endpoints and model providers, this can unexpectedly redirect future Codex traffic, disrupt existing configuration, or cause loss of user settings if the grep-based filtering removes more than intended.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The agent-facing context aggregation is described as exposing user messages, Codex replies, and tool-call summaries in natural-language form. Natural-language summaries can still reveal credentials, internal code details, customer data, or operational context, and making them agent-accessible increases the chance of unintended disclosure or overcollection.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to aggregate and read recent Codex sessions and full conversation contents for one-shot access, which creates a direct mechanism for bulk exposure of sensitive historical interactions. In the context of an agent integration skill, this is especially dangerous because session logs may contain secrets, proprietary code snippets, credentials, internal file paths, and user intent data unrelated to the current task.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The script is intentionally designed to aggregate local Codex configuration, project trust metadata, session indexes, recent user messages, agent replies, and tool-call summaries into one report for agent consumption. In this skill context, that is more dangerous than normal logging because it concentrates sensitive operational history and user content into a single output stream that can be copied, ingested by another agent, or exposed in logs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.