📦
Historial de auditorías
ralph - 4 auditorías
Comparación de versiones
Cambios de capacidades y hallazgos entre versiones auditadas, primero las más recientes.
| Versión | Fecha | Resultado | Elementos de revisión | Cambio vs anterior |
|---|---|---|---|---|
| v4 Más reciente | 7 jul 2026, 05:35 | 2 confirmado | 24 | Sin cambios de capacidad |
| v3 | 7 jul 2026, 05:35 | 2 confirmado | 24 | Contiene scripts |
| v2 | 30 jun 2026, 23:15 | 3 confirmado | 1 | Comandos externosAcceso a red |
| v1 | 13 mar 2026, 08:19 | Sin hallazgos confirmados | 0 | Base |
Versión de auditoría 4 Más reciente
7 jul 2026, 05:35
Most external-command findings are false positives caused by Markdown backticks, fenced examples, or literal prompt text. The confirmed risks are persistent writes to hidden agent configuration, Codex developer instruction injection, and broad Gemini hook guidance that can change agent behavior beyond one task.
3
Archivos escaneados
935
Líneas analizadas
29
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (2)
Crítico
Prompt Injection Attempt Detected
The setup script appends a new Codex developer_instructions contract with phrases like "Ouroboros specification-first workflow is active" and "continue immediately". This persists agent behavior outside the skill session.
The file directly defines the persistent instruction text and writes it into ~/.codex/config.toml. This is a clear agent-instruction persistence mechanism.
Alto
Wildcard AfterAgent Hook With Reduced Confirmation
SKILL.md instructs Gemini users to add an AfterAgent hook with matcher * that runs a bash command from ~/.gemini, then suggests sandbox plus yes mode to reduce prompts.
The hook configuration and reduced-confirmation command are shown together in the documented install flow. This creates broad automatic command execution risk if followed.
Elementos de revisión de capacidades (24)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Hidden file in home directory
# 1) developer_instructions → ~/.codex/config.toml (ooo command contract)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
# 2) ~/.codex/prompts/ralph.md (load via /prompts:ralph)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
# 3) ~/.codex/prompts/ouroboros.md (load via /prompts:ouroboros)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 1. Adds ooo command contract to ~/.codex/config.toml developer_instructions"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 2. Creates ~/.codex/prompts/ralph.md for /prompts:ralph"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 3. Creates ~/.codex/prompts/ouroboros.md for /prompts:ouroboros"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 1) developer_instructions → ~/.codex/config.toml (ooo command contract)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 2) ~/.codex/prompts/ralph.md (load via /prompts:ralph)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 3) ~/.codex/prompts/ouroboros.md (load via /prompts:ouroboros)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 1. Adds ooo command contract to ~/.codex/config.toml developer_instructions"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 2. Creates ~/.codex/prompts/ralph.md for /prompts:ralph"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 3. Creates ~/.codex/prompts/ouroboros.md for /prompts:ouroboros"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
CODEX_DIR="$HOME/.codex"
This defines ~/.codex as the target directory and the script later writes config and prompt files under it. Hidden home-directory agent configuration can persist behavior across sessions.
Alto
Python file write/append
with open(path, "w") as out:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Python file write/append
with open(path, "a") as out:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Python file write/append
with open(path, 'a') as f:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Hidden file in home directory
Required in `~/.gemini/settings.json`:
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
"includeDirectories": ["~/.gemini/extensions/ralph"]
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
AfterAgent hook for loop continuation (add to `~/.gemini/settings.json`):
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
"command": "bash ~/.gemini/hooks/ralph-check.sh",
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
Required in `~/.gemini/settings.json`:
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
"includeDirectories": ["~/.gemini/extensions/ralph"]
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
AfterAgent hook for loop continuation (add to `~/.gemini/settings.json`):
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
"command": "bash ~/.gemini/hooks/ralph-check.sh",
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Factores de riesgo
⚙️ Comandos externos (155)
scripts/setup-codex-hook.sh:79 scripts/setup-codex-hook.sh:163 scripts/setup-codex-hook.sh:164 scripts/setup-codex-hook.sh:166 scripts/setup-codex-hook.sh:170 scripts/setup-codex-hook.sh:171-182 scripts/setup-codex-hook.sh:182-186 scripts/setup-codex-hook.sh:186-195 scripts/setup-codex-hook.sh:195-198 scripts/setup-codex-hook.sh:198-206 scripts/setup-codex-hook.sh:206-212 scripts/setup-codex-hook.sh:212 scripts/setup-codex-hook.sh:213-214 scripts/setup-codex-hook.sh:214-215 scripts/setup-codex-hook.sh:215-216 scripts/setup-codex-hook.sh:216-221 scripts/setup-codex-hook.sh:221-229 scripts/setup-codex-hook.sh:229-258 scripts/setup-codex-hook.sh:258-262 scripts/setup-codex-hook.sh:262-268 scripts/setup-codex-hook.sh:268-269 scripts/setup-codex-hook.sh:269-270 scripts/setup-codex-hook.sh:270-271 scripts/setup-codex-hook.sh:271-272 scripts/setup-codex-hook.sh:272-273 scripts/setup-codex-hook.sh:273-274 scripts/setup-codex-hook.sh:274-275 scripts/setup-codex-hook.sh:275-279 scripts/setup-codex-hook.sh:279-284 scripts/setup-codex-hook.sh:284-288 scripts/setup-codex-hook.sh:288-291 scripts/setup-codex-hook.sh:291-309 scripts/setup-codex-hook.sh:309-310 scripts/setup-codex-hook.sh:310-311 scripts/setup-codex-hook.sh:311-312 scripts/setup-codex-hook.sh:312-313 scripts/setup-codex-hook.sh:313-317 scripts/setup-codex-hook.sh:317 scripts/setup-codex-hook.sh:318-319 SKILL.md:36-40 SKILL.md:40-46 SKILL.md:46-56 SKILL.md:56-67 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:86-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-103 SKILL.md:103-110 SKILL.md:110-113 SKILL.md:113-120 SKILL.md:120-124 SKILL.md:124-126 SKILL.md:126-129 SKILL.md:129-146 SKILL.md:146-150 SKILL.md:150-153 SKILL.md:153-157 SKILL.md:157-159 SKILL.md:159-168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170-176 SKILL.md:176-179 SKILL.md:179-186 SKILL.md:186-206 SKILL.md:206-210 SKILL.md:210-211 SKILL.md:211-222 SKILL.md:222-226 SKILL.md:226-241 SKILL.md:241-245 SKILL.md:245-273 SKILL.md:273-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281 SKILL.md:287-290 SKILL.md:290-294 SKILL.md:294-299 SKILL.md:299-303 SKILL.md:303-310 SKILL.md:310-323 SKILL.md:323-329 SKILL.md:329-333 SKILL.md:333-336 SKILL.md:336-362 SKILL.md:362-369 SKILL.md:369-372 SKILL.md:372-373 SKILL.md:373-374 SKILL.md:374-375 SKILL.md:375-376 SKILL.md:376-384 SKILL.md:384-398 SKILL.md:398-400 SKILL.md:400-401 SKILL.md:401-402 SKILL.md:402-403 SKILL.md:403-405 SKILL.md:405-406 SKILL.md:406-414 SKILL.md:414-420 SKILL.md:420-431 SKILL.md:431-434 SKILL.md:434-435 SKILL.md:435-440 SKILL.md:440-442 SKILL.md:442-445 SKILL.md:445-446 SKILL.md:446-447 SKILL.md:447-448 SKILL.md:448 SKILL.md:452-457 SKILL.md:457-459 SKILL.md:459-460 SKILL.md:460-467 SKILL.md:467-469 SKILL.md:469-470 SKILL.md:470-483 SKILL.md:483-486 SKILL.md:486-488 SKILL.md:488-490 SKILL.md:490-491 SKILL.md:491-494 SKILL.md:494-496 SKILL.md:496 SKILL.md:497-505 SKILL.md:505-506 SKILL.md:506-507 SKILL.md:507-508 SKILL.md:508-516 SKILL.md:516-517 SKILL.md:517-518 SKILL.md:518-519 SKILL.md:519-520 SKILL.md:520-521 SKILL.md:521-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-534 SKILL.md:534-548
🌐 Acceso a red (6)
📁 Acceso al sistema de archivos (28)
scripts/setup-codex-hook.sh:5 scripts/setup-codex-hook.sh:6 scripts/setup-codex-hook.sh:7 scripts/setup-codex-hook.sh:29 scripts/setup-codex-hook.sh:30 scripts/setup-codex-hook.sh:31 scripts/setup-codex-hook.sh:5 scripts/setup-codex-hook.sh:6 scripts/setup-codex-hook.sh:7 scripts/setup-codex-hook.sh:29 scripts/setup-codex-hook.sh:30 scripts/setup-codex-hook.sh:31 scripts/setup-codex-hook.sh:42 scripts/setup-codex-hook.sh:55 scripts/setup-codex-hook.sh:90 scripts/setup-codex-hook.sh:98 scripts/setup-codex-hook.sh:144 scripts/setup-codex-hook.sh:119 scripts/setup-codex-hook.sh:125 scripts/setup-codex-hook.sh:141 SKILL.md:459 SKILL.md:464 SKILL.md:469 SKILL.md:477 SKILL.md:459 SKILL.md:464 SKILL.md:469 SKILL.md:477
Auditado por: codex
7 jul 2026, 05:35
Most external-command findings are false positives caused by Markdown backticks, fenced examples, or literal prompt text. The confirmed risks are persistent writes to hidden agent configuration, Codex developer instruction injection, and broad Gemini hook guidance that can change agent behavior beyond one task.
3
Archivos escaneados
935
Líneas analizadas
29
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (2)
Crítico
Prompt Injection Attempt Detected
The setup script appends a new Codex developer_instructions contract with phrases like "Ouroboros specification-first workflow is active" and "continue immediately". This persists agent behavior outside the skill session.
The file directly defines the persistent instruction text and writes it into ~/.codex/config.toml. This is a clear agent-instruction persistence mechanism.
Alto
Wildcard AfterAgent Hook With Reduced Confirmation
SKILL.md instructs Gemini users to add an AfterAgent hook with matcher * that runs a bash command from ~/.gemini, then suggests sandbox plus yes mode to reduce prompts.
The hook configuration and reduced-confirmation command are shown together in the documented install flow. This creates broad automatic command execution risk if followed.
Elementos de revisión de capacidades (24)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Hidden file in home directory
# 1) developer_instructions → ~/.codex/config.toml (ooo command contract)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
# 2) ~/.codex/prompts/ralph.md (load via /prompts:ralph)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
# 3) ~/.codex/prompts/ouroboros.md (load via /prompts:ouroboros)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 1. Adds ooo command contract to ~/.codex/config.toml developer_instructions"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 2. Creates ~/.codex/prompts/ralph.md for /prompts:ralph"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file in home directory
echo " 3. Creates ~/.codex/prompts/ouroboros.md for /prompts:ouroboros"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 1) developer_instructions → ~/.codex/config.toml (ooo command contract)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 2) ~/.codex/prompts/ralph.md (load via /prompts:ralph)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
# 3) ~/.codex/prompts/ouroboros.md (load via /prompts:ouroboros)
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 1. Adds ooo command contract to ~/.codex/config.toml developer_instructions"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 2. Creates ~/.codex/prompts/ralph.md for /prompts:ralph"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
echo " 3. Creates ~/.codex/prompts/ouroboros.md for /prompts:ouroboros"
The line is descriptive text, but it names the hidden Codex home configuration targets that this setup script later creates or writes. Persisting agent prompts and developer instructions in ~/.codex is a real configuration risk.
Alto
Hidden file access
CODEX_DIR="$HOME/.codex"
This defines ~/.codex as the target directory and the script later writes config and prompt files under it. Hidden home-directory agent configuration can persist behavior across sessions.
Alto
Python file write/append
with open(path, "w") as out:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Python file write/append
with open(path, "a") as out:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Python file write/append
with open(path, 'a') as f:
The Python write appends or rewrites Codex developer_instructions in ~/.codex/config.toml. Persistently changing agent instructions is a high-impact configuration risk.
Alto
Hidden file in home directory
Required in `~/.gemini/settings.json`:
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
"includeDirectories": ["~/.gemini/extensions/ralph"]
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
AfterAgent hook for loop continuation (add to `~/.gemini/settings.json`):
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file in home directory
"command": "bash ~/.gemini/hooks/ralph-check.sh",
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
Required in `~/.gemini/settings.json`:
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
"includeDirectories": ["~/.gemini/extensions/ralph"]
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
AfterAgent hook for loop continuation (add to `~/.gemini/settings.json`):
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Alto
Hidden file access
"command": "bash ~/.gemini/hooks/ralph-check.sh",
The documentation instructs users to modify hidden Gemini configuration or run hooks from ~/.gemini. This is user-directed, but it expands persistent agent hook and shell execution surface.
Factores de riesgo
⚙️ Comandos externos (155)
scripts/setup-codex-hook.sh:79 scripts/setup-codex-hook.sh:163 scripts/setup-codex-hook.sh:164 scripts/setup-codex-hook.sh:166 scripts/setup-codex-hook.sh:170 scripts/setup-codex-hook.sh:171-182 scripts/setup-codex-hook.sh:182-186 scripts/setup-codex-hook.sh:186-195 scripts/setup-codex-hook.sh:195-198 scripts/setup-codex-hook.sh:198-206 scripts/setup-codex-hook.sh:206-212 scripts/setup-codex-hook.sh:212 scripts/setup-codex-hook.sh:213-214 scripts/setup-codex-hook.sh:214-215 scripts/setup-codex-hook.sh:215-216 scripts/setup-codex-hook.sh:216-221 scripts/setup-codex-hook.sh:221-229 scripts/setup-codex-hook.sh:229-258 scripts/setup-codex-hook.sh:258-262 scripts/setup-codex-hook.sh:262-268 scripts/setup-codex-hook.sh:268-269 scripts/setup-codex-hook.sh:269-270 scripts/setup-codex-hook.sh:270-271 scripts/setup-codex-hook.sh:271-272 scripts/setup-codex-hook.sh:272-273 scripts/setup-codex-hook.sh:273-274 scripts/setup-codex-hook.sh:274-275 scripts/setup-codex-hook.sh:275-279 scripts/setup-codex-hook.sh:279-284 scripts/setup-codex-hook.sh:284-288 scripts/setup-codex-hook.sh:288-291 scripts/setup-codex-hook.sh:291-309 scripts/setup-codex-hook.sh:309-310 scripts/setup-codex-hook.sh:310-311 scripts/setup-codex-hook.sh:311-312 scripts/setup-codex-hook.sh:312-313 scripts/setup-codex-hook.sh:313-317 scripts/setup-codex-hook.sh:317 scripts/setup-codex-hook.sh:318-319 SKILL.md:36-40 SKILL.md:40-46 SKILL.md:46-56 SKILL.md:56-67 SKILL.md:67 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:86-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-103 SKILL.md:103-110 SKILL.md:110-113 SKILL.md:113-120 SKILL.md:120-124 SKILL.md:124-126 SKILL.md:126-129 SKILL.md:129-146 SKILL.md:146-150 SKILL.md:150-153 SKILL.md:153-157 SKILL.md:157-159 SKILL.md:159-168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170-176 SKILL.md:176-179 SKILL.md:179-186 SKILL.md:186-206 SKILL.md:206-210 SKILL.md:210-211 SKILL.md:211-222 SKILL.md:222-226 SKILL.md:226-241 SKILL.md:241-245 SKILL.md:245-273 SKILL.md:273-279 SKILL.md:279-280 SKILL.md:280-281 SKILL.md:281 SKILL.md:287-290 SKILL.md:290-294 SKILL.md:294-299 SKILL.md:299-303 SKILL.md:303-310 SKILL.md:310-323 SKILL.md:323-329 SKILL.md:329-333 SKILL.md:333-336 SKILL.md:336-362 SKILL.md:362-369 SKILL.md:369-372 SKILL.md:372-373 SKILL.md:373-374 SKILL.md:374-375 SKILL.md:375-376 SKILL.md:376-384 SKILL.md:384-398 SKILL.md:398-400 SKILL.md:400-401 SKILL.md:401-402 SKILL.md:402-403 SKILL.md:403-405 SKILL.md:405-406 SKILL.md:406-414 SKILL.md:414-420 SKILL.md:420-431 SKILL.md:431-434 SKILL.md:434-435 SKILL.md:435-440 SKILL.md:440-442 SKILL.md:442-445 SKILL.md:445-446 SKILL.md:446-447 SKILL.md:447-448 SKILL.md:448 SKILL.md:452-457 SKILL.md:457-459 SKILL.md:459-460 SKILL.md:460-467 SKILL.md:467-469 SKILL.md:469-470 SKILL.md:470-483 SKILL.md:483-486 SKILL.md:486-488 SKILL.md:488-490 SKILL.md:490-491 SKILL.md:491-494 SKILL.md:494-496 SKILL.md:496 SKILL.md:497-505 SKILL.md:505-506 SKILL.md:506-507 SKILL.md:507-508 SKILL.md:508-516 SKILL.md:516-517 SKILL.md:517-518 SKILL.md:518-519 SKILL.md:519-520 SKILL.md:520-521 SKILL.md:521-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-534 SKILL.md:534-548
🌐 Acceso a red (6)
📁 Acceso al sistema de archivos (28)
scripts/setup-codex-hook.sh:5 scripts/setup-codex-hook.sh:6 scripts/setup-codex-hook.sh:7 scripts/setup-codex-hook.sh:29 scripts/setup-codex-hook.sh:30 scripts/setup-codex-hook.sh:31 scripts/setup-codex-hook.sh:5 scripts/setup-codex-hook.sh:6 scripts/setup-codex-hook.sh:7 scripts/setup-codex-hook.sh:29 scripts/setup-codex-hook.sh:30 scripts/setup-codex-hook.sh:31 scripts/setup-codex-hook.sh:42 scripts/setup-codex-hook.sh:55 scripts/setup-codex-hook.sh:90 scripts/setup-codex-hook.sh:98 scripts/setup-codex-hook.sh:144 scripts/setup-codex-hook.sh:119 scripts/setup-codex-hook.sh:125 scripts/setup-codex-hook.sh:141 SKILL.md:459 SKILL.md:464 SKILL.md:469 SKILL.md:477 SKILL.md:459 SKILL.md:464 SKILL.md:469 SKILL.md:477
Auditado por: codex
30 jun 2026, 23:15
Static analysis produced many hits, but most SKILL.md external-command, URL, and weak-crypto findings are documentation examples or symbolic formulas. The confirmed risk is the setup script, which writes persistent Codex configuration and prompt files under the user home directory, including loop instructions that can change future agent behavior.
3
Archivos escaneados
935
Líneas analizadas
8
Elementos de revisión
4
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (3)
Alto
scripts/setup-codex-hook.sh:42-47scripts/setup-codex-hook.sh:62scripts/setup-codex-hook.sh:97-147scripts/setup-codex-hook.sh:234-241scripts/setup-codex-hook.sh:324-331
Persistent Codex Configuration Modification
The setup script creates or modifies files under ~/.codex, including config.toml and prompt files. This is a real filesystem risk because it persists workflow instructions across future Codex sessions and changes agent behavior outside the current task.
The script clearly defines ~/.codex targets and writes persistent config and prompt files. The behavior is intentional setup logic, but it materially changes future agent instructions.
Alto
scripts/setup-codex-hook.sh:65-86scripts/setup-codex-hook.sh:157-232scripts/setup-codex-hook.sh:248-322SKILL.md:174-240SKILL.md:433-448
Persistent Agent Behavior Instructions
The skill installs developer instructions and prompt content that tell the agent to continue loops until a promise or iteration cap is reached. This is not confirmed malware, but it is a high-impact persistence mechanism for agent behavior.
The content explicitly defines persistent loop behavior and writes it into Codex prompt/config files. A max-iteration cap reduces risk, but persistent instruction injection remains significant.
Medio
scripts/setup-codex-hook.sh:21-24scripts/setup-codex-hook.sh:42-47scripts/setup-codex-hook.sh:94-100scripts/setup-codex-hook.sh:237-240scripts/setup-codex-hook.sh:327-330
Home Directory Dotfile Writes Require Explicit Consent
The hidden-file findings are true positives for home directory writes. The script supports --dry-run, but normal execution writes dotfiles and should require clear user consent before installation.
The --dry-run option is visible, but normal mode writes to hidden home-directory files. This is legitimate installer behavior with elevated marketplace risk.
Necesita revisar los hallazgos (1)
Estos hallazgos provienen de veredictos de auditoría heredados inciertos, por lo que requieren revisión, pero no se cuentan como problemas de seguridad confirmados.
Medio
Shell And Python Execution During Setup
The setup helper invokes shell commands and Python snippets to edit configuration. The inputs are mostly fixed strings, so command injection evidence is limited, but execution is real and affects local configuration.
The command and Python execution paths are present and used for installation. I did not find evidence of user-controlled shell interpolation beyond installer arguments.
Falsos positivos estáticos ignorados (4)
Estas coincidencias estáticas fueron descartadas por la revisión semántica o coincidieron con tokens solo de esquema, por lo que se muestran por transparencia, pero no afectan la puntuación de calidad.
Bajo
Documentation Command Examples Flagged As Execution
Most external-command findings in SKILL.md are markdown examples, tables, or code blocks that describe ooo, claude, gemini, and npx commands. They are not executed by the skill file itself.
The flagged lines are documentation and examples, not active code. The separate setup script is the executable component and is covered in higher-severity findings.
Bajo
Hardcoded URLs Are Installation References
The network findings are GitHub repository URLs shown in installation documentation and source attribution. No evidence found that the local setup script sends data to those URLs.
The URLs appear in install instructions and attribution. I did not find fetch, curl, upload, or credential transmission behavior in the script.
Bajo
Weak Cryptography Findings Are Symbolic Formula Matches
The weak-cryptography hits appear to be caused by comparison symbols, formulas, or compact TOON notation. No evidence found of MD5, SHA1, DES, or other weak algorithm use.
The cited areas describe ambiguity and similarity scoring, not cryptographic operations. The scanner likely matched symbols or short tokens out of context.
Bajo
Standard Device Redirects And Reconnaissance Are Benign
The /dev/null redirects and command -v codex check are standard setup-script patterns. They check tool availability and suppress expected errors, not collect sensitive host data.
The commands are limited to availability checks and error redirection. I did not find broader system inventory or outbound reporting.
Factores de riesgo
⚡ Contiene scripts (2)
📁 Acceso al sistema de archivos (6)
⚙️ Comandos externos (5)
🌐 Acceso a red (4)
Patrones detectados
Writes To Persistent Agent ConfigurationAutonomous Loop Instructions
Auditado por: codex
13 mar 2026, 08:19
This is a legitimate AI development methodology skill. Static findings for external_commands (194), network (6), and filesystem (28) are false positives - the script uses standard shell operations for CLI tool configuration, URLs are GitHub references in documentation, and hidden file access is for configuration files. No malicious intent detected.
3
Archivos escaneados
935
Líneas analizadas
2
Elementos de revisión
0
Falsos positivos ignorados
Factores de riesgo
⚡ Contiene scripts (3)
📁 Acceso al sistema de archivos (3)
Auditado por: claude