Historial de auditorías

SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:56

System Skill Overwrite Permission

The skill permits downloading and overwriting preinstalled system skills after user insistence. Replacing trusted system instructions can persist malicious behavior across later sessions.

Line 55 directly permits overwriting preinstalled system skills, crossing the documented trust boundary.

Factores de riesgo

⚙️ Comandos externos (10)

🌐 Acceso a red (4)

SKILL.md:46 SKILL.md:10 SKILL.md:46 SKILL.md:52 SKILL.md:55

📁 Acceso al sistema de archivos (5)

🔑 Variables de entorno (1)

SKILL.md:15 SKILL.md:38-39 SKILL.md:46

Auditado por: codex

Versión de auditoría 9

10 jul 2026, 13:01

The Markdown command examples and dotted GitHub paths are mostly scanner false positives. Real risks remain from network retrieval, writes into Codex skill storage, arbitrary third-party installation, and instructions permitting system-skill replacement.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

Unreviewed Third-Party Skill Installation

The instructions allow arbitrary GitHub skills to be downloaded into the active Codex skill directory without required review, allowlisting, or integrity verification.

The source explicitly combines arbitrary repository input with installation into Codex skill storage. No source validation or review requirement is stated.

Alto

Preinstalled System Skill Replacement

The instructions permit downloading and overwriting preinstalled system skills when a user insists, which can replace trusted behavior with remote content.

Line 55 explicitly authorizes an overwrite exception for preinstalled system skills. Replacing trusted skills is a direct persistence and integrity risk.

Elementos de revisión de capacidades (6)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

Hidden file in home directory

- Installs into `$CODEX_HOME/skills/<skill-name>` (defaults to `~/.codex/skills`).

The installer writes into ~/.codex/skills by default. Files placed there can persist and affect later Codex behavior.

Medio

Hidden file access

- Installs into `$CODEX_HOME/skills/<skill-name>` (defaults to `~/.codex/skills`).

The documented default destination is the hidden local ~/.codex/skills directory. Installation requires writing within that directory.

Bajo

SKILL.md:10

Hardcoded URL

Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.c

The skill explicitly uses a remote GitHub source by default and permits other locations. Network retrieval is an intended capability.

Bajo

SKILL.md:39

Hardcoded URL

- `scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>`

The documented installer accepts GitHub tree URLs for remote skill downloads. This creates an intended network dependency.

Bajo

SKILL.md:52

Hardcoded URL

- Curated listing is fetched from `https://github.com/openai/skills/tree/main/skills/.curated` via t

The line explicitly states that the curated listing is fetched through the GitHub API. Network access is confirmed.

Bajo

SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:56

Hardcoded URL

- The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no ne

The line permits downloading system skills from the referenced GitHub location. The URL is trusted, but remote retrieval remains security-relevant.

Factores de riesgo

⚙️ Comandos externos (10)

🌐 Acceso a red (4)

SKILL.md:46 SKILL.md:10 SKILL.md:46 SKILL.md:52 SKILL.md:55

📁 Acceso al sistema de archivos (5)

🔑 Variables de entorno (1)

SKILL.md:15 SKILL.md:38-39 SKILL.md:46

Auditado por: codex

Versión de auditoría 8

5 jul 2026, 10:13

The Markdown backtick detections are mixed: some lines are only documentation, while the script section still directs assistants to run installer helpers. The main security concerns are remote skill installation into CODEX_HOME, possible overwrite of preinstalled system skills, and use of GitHub credentials for private repositories.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

Remote Skill Supply Chain Installation

The skill directs installation from arbitrary GitHub repositories into the Codex skills directory. Remote skill content can alter later agent behavior after installation.

The file directly describes installing from other repositories and writing into CODEX_HOME skills. This is the core workflow, so confidence is high.

Alto

Preinstalled Skill Overwrite Capability

The instructions allow downloading and overwriting preinstalled system skills when a user insists. Replacing preinstalled skills can undermine trusted assistant behavior.

Line 55 explicitly mentions preinstalled skills and permits overwrite on request. The security impact is clear because skills influence future agent instructions.

Elementos de revisión de capacidades (12)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

SKILL.md:38

Ruby/shell backtick execution

- `scripts/install-skill-from-github.py --repo <owner>/<repo> --path <path/to/skill> [<path/to/skill

The install helper accepts user-provided repository and path values, then installs remote skill content. That creates command execution and supply-chain risk around untrusted inputs.

Alto

SKILL.md:39

Ruby/shell backtick execution

- `scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>`

The URL-based install helper accepts a GitHub tree URL and can fetch remote skill content. The command is intentional behavior and can install untrusted repository content.

Alto

Hidden file in home directory

- Installs into `$CODEX_HOME/skills/<skill-name>` (defaults to `~/.codex/skills`).

The skill installs into CODEX_HOME or defaults to ~/.codex/skills. Writing remote skill content into a hidden agent configuration directory can change future agent behavior.

Alto

Hidden file access

- Installs into `$CODEX_HOME/skills/<skill-name>` (defaults to `~/.codex/skills`).

The destination defaults to ~/.codex/skills, a hidden directory that controls installed Codex skills. This is a real filesystem modification with security impact.

Alto

Hidden file access

- The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no ne

The line says preinstalled system skills can be downloaded and overwritten if the user insists. That is a real filesystem overwrite path affecting trusted skill behavior.

Alto

Git platform tokens

- Private GitHub repos can be accessed via existing git credentials or optional `GITHUB_TOKEN`/`GH_T

The skill explicitly allows private GitHub access through GITHUB_TOKEN or GH_TOKEN. These credentials can grant repository access and must be handled as secrets.

Medio

SKILL.md:36

Ruby/shell backtick execution

- `scripts/list-curated-skills.py` (prints curated list with installed annotations)

This line identifies a helper script that the skill tells the assistant to run when listing curated skills. It is not Ruby backtick execution, but it is still intentional external command execution.

Medio

SKILL.md:37

Ruby/shell backtick execution

- `scripts/list-curated-skills.py --format json`

The listed JSON-mode helper is part of the skill workflow and would execute a local script. The risk is external command use, not the Markdown backtick syntax itself.

Medio

SKILL.md:39

Hardcoded URL

- `scripts/install-skill-from-github.py --url https://github.com/<owner>/<repo>/tree/<ref>/<path>`

The URL template supports installing from GitHub tree URLs supplied by the user. This can fetch and install remote content, so the network behavior is security relevant.

Medio

SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:56

Hardcoded URL

- The skills at https://github.com/openai/skills/tree/main/skills/.system are preinstalled, so no ne

This line references downloading skills from the OpenAI system skills repository and potentially overwriting installed copies. The network source is expected, but the overwrite context increases impact.

Bajo

SKILL.md:10

Hardcoded URL

Helps install skills. By default these are from https://github.com/openai/skills/tree/main/skills/.c

The skill states that the default source is a GitHub URL. This is transparent and expected, but it is still a network dependency for marketplace installation behavior.

Bajo

SKILL.md:52

Hardcoded URL

- Curated listing is fetched from `https://github.com/openai/skills/tree/main/skills/.curated` via t

The skill says curated listings are fetched from GitHub through the API. The domain is expected, but the skill still depends on live network access.

Factores de riesgo

⚙️ Comandos externos (10)

🌐 Acceso a red (4)

SKILL.md:46 SKILL.md:10 SKILL.md:46 SKILL.md:52 SKILL.md:55

📁 Acceso al sistema de archivos (5)

🔑 Variables de entorno (1)

SKILL.md:38-39 SKILL.md:46-48 SKILL.md:55

Auditado por: codex

Versión de auditoría 7

29 jun 2026, 14:58

The static shell-execution and weak-crypto findings are mostly false positives from markdown command examples and ordinary prose. Real medium-risk behavior remains because the skill instructs agents to download skills from GitHub, write into the local Codex skills directory, and optionally use Git credentials or GitHub tokens for private repositories.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Elementos de revisión de capacidades (5)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

Remote Skill Installation Can Modify Agent Behavior

The skill installs remote GitHub content into $CODEX_HOME/skills and says users can overwrite preinstalled system skills if they insist. This is legitimate installer behavior, but it can change future agent instructions and should be treated as a supply-chain risk.

The file directly describes installing GitHub-sourced skills into the Codex skills directory. No malicious repository is hardcoded, but the behavior has clear security impact.

Medio

SKILL.md:53-54

Private Repository Installs May Use Git Credentials

The skill allows private GitHub repository access through existing git credentials or optional GITHUB_TOKEN and GH_TOKEN values. This is expected for private installs, but it raises credential-handling risk if helper implementations are unsafe.

The token names and private-repository behavior are explicitly documented. I did not find evidence in SKILL.md that credentials are exfiltrated.

Medio

SKILL.md:34-39

Sandbox Escalation Requested For Network Scripts

The skill tells agents to request escalation when running its network helper scripts. This may be reasonable for network access, but marketplace users should know the workflow can require elevated execution approval.

The escalation instruction is present, but the referenced helper scripts are not included in the scanned package. The risk depends on the runtime environment and script implementation.

Bajo

SKILL.md:36-39 SKILL.md:46-48 SKILL.md:52-56

Markdown Command Examples Triggered Execution Heuristics

The external-command detections are markdown references to script paths and command options, not executable code in the scanned file. This reduces the command-injection concern for this package, although the intended workflow still involves running helper scripts.

The flagged content is visibly markdown prose and inline code spans. No executable source file or shell wrapper was present in the scanned file structure.

Bajo

SKILL.md:3-5 SKILL.md:14-15 SKILL.md:45-48

Hardcoded URLs Point To GitHub Skill Sources

The network findings identify GitHub URLs used to describe curated and system skill locations. These URLs are expected for a skill installer and do not show a hidden exfiltration endpoint.

All detected URLs are GitHub locations related to skill listing or installation. No evidence found of an unrelated collection server.

Falsos positivos estáticos ignorados (1)

Estas coincidencias estáticas fueron descartadas por la revisión semántica o coincidieron con tokens solo de esquema, por lo que se muestran por transparencia, pero no afectan la puntuación de calidad.

Bajo

Weak Cryptography Findings Are False Positives

The lines flagged as weak cryptography contain metadata, installation prose, destination behavior, or option names. No cryptographic algorithm use was found in SKILL.md.

The cited lines do not mention MD5, SHA-1, DES, RC4, or any other cryptographic operation. This appears to be a scanner heuristic mismatch.

Factores de riesgo

⚙️ Comandos externos (3)

SKILL.md:36-39 SKILL.md:46-48 SKILL.md:52-56

🌐 Acceso a red (4)

SKILL.md:46-48 SKILL.md:55-56

📁 Acceso al sistema de archivos (2)

🔑 Variables de entorno (1)

Patrones detectados

Network Download Plus Local Skill Directory WritesOptional Credential Use During Remote Fetch

Auditado por: codex

Versión de auditoría 6

21 ene 2026, 19:36

This skill provides legitimate package management functionality for installing Codex skills from GitHub repositories. The static analyzer detected numerous false positives from JSON content. Network access and filesystem operations are appropriate for a skill installer. The skill references helper scripts that are not present in the directory, which may cause runtime errors but does not pose a security threat.

Archivos escaneados

607

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Bajo

SKILL.md:36-39

Missing Helper Scripts

The SKILL.md documentation references Python helper scripts in a scripts directory that are not present in the skill directory. This will cause runtime errors when the skill attempts to execute these scripts but does not pose a security threat.

Bajo

GitHub Token Environment Variable Access

The skill documentation mentions accessing GITHUB_TOKEN or GH_TOKEN environment variables for private repository authentication. This is legitimate functionality for accessing private GitHub repositories but users should be aware of credential usage.

Factores de riesgo

🌐 Acceso a red (4)

SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:46 SKILL.md:46 SKILL.md:47 SKILL.md:47 SKILL.md:48 SKILL.md:48 SKILL.md:48 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:53 SKILL.md:56

⚙️ Comandos externos (16)

📁 Acceso al sistema de archivos (5)

SKILL.md:46 SKILL.md:10 SKILL.md:46 SKILL.md:52 SKILL.md:55

🔑 Variables de entorno (2)

SKILL.md:53 SKILL.md:53

Auditado por: claude

Versión de auditoría 5

17 ene 2026, 02:38

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Archivos escaneados

233

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Factores de riesgo

🌐 Acceso a red (4)

SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:46 SKILL.md:46 SKILL.md:47 SKILL.md:47 SKILL.md:48 SKILL.md:48 SKILL.md:48 SKILL.md:48 SKILL.md:52 SKILL.md:53 SKILL.md:53 SKILL.md:56

🔑 Variables de entorno (2)

SKILL.md:53 SKILL.md:53

⚙️ Comandos externos (16)

📁 Acceso al sistema de archivos (5)

SKILL.md:46 SKILL.md:10 SKILL.md:46 SKILL.md:52 SKILL.md:55

Patrones detectados

Hardcoded URLGit platform tokensWeak cryptographic algorithmRuby/shell backtick executionHidden file in home directoryHidden file access[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

Auditado por: claude

Versión de auditoría 4

17 ene 2026, 02:38

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Archivos escaneados

233

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Factores de riesgo

🌐 Acceso a red (4)