Versioned security assessment

Report ID: SA-1B5B6C49

7/7/2026, 6:34:33 PM

commit-chat-push security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
commit-chat-push
Version
v5
Maintainer
bertona88
Source
github.com/bertona88/commit-chat-push/tree/main/
Coverage
3 Files scanned · 220 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static command findings are Markdown examples, fixed Git checks, or defensive secret scans. The material risk is the intended export, commit, and push of Codex session transcripts from ~/.codex/sessions. No prompt injection attempt was found in the reviewed files, but the referenced redaction exporter was not present in the scanned package.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 220 Lines analyzed

14 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 7 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 34 evidence locations

Capability review items (12)
High
README.md:3
Hidden file in home directory
Commit Chat Push is a Codex skill for shipping code with its implementation provenance. It guides Co
The README states the skill exports transcripts from ~/.codex/sessions and pushes the branch. Codex session files can contain sensitive prompts, commands, and paths.
High
README.md:3
Hidden file access
Commit Chat Push is a Codex skill for shipping code with its implementation provenance. It guides Co
The README describes reading hidden Codex session data for source-controlled provenance. That access can expose private session content if the transcript is committed or pushed.
High
SKILL.md:3
Hidden file in home directory
description: Commit and push repository changes while also exporting and committing the Codex chat/s
The skill description says it preserves the implementation chat from ~/.codex/sessions. Those hidden session files can contain sensitive prompts and tool context.
High
SKILL.md:62
Hidden file in home directory
- Do not commit raw `~/.codex/sessions/*.jsonl` unless the user explicitly asks for raw logs after b
The line permits committing raw ~/.codex/sessions JSONL if the user explicitly asks after a warning. Raw session logs are high-risk sensitive data.
High
SKILL.md:3
Hidden file access
description: Commit and push repository changes while also exporting and committing the Codex chat/s
The description establishes hidden Codex session access as core behavior. Exporting that content into source control can disclose private session data.
High
SKILL.md:62
Hidden file access
- Do not commit raw `~/.codex/sessions/*.jsonl` unless the user explicitly asks for raw logs after b
The line discusses committing raw Codex session JSONL after user warning. Such files can contain secrets, system context, and local paths.
Medium
SKILL.md:42-49
Ruby/shell backtick execution
```bash
The bash block invokes a transcript exporter from the Codex skill directory. Because it processes local session data, running it has privacy impact even if intended.
Medium
SKILL.md:51
Ruby/shell backtick execution
- If `--require-anchor` fails, wait briefly and rerun with the same marker. If it still fails, inspe
The fallback guidance tells the agent to inspect candidate sessions and rerun with a session path. Manual selection can expose the wrong local session if handled poorly.
Medium
SKILL.md:80-81
Ruby/shell backtick execution
- If the branch already has an upstream, run `git push`.
The skill instructs the agent to run git push when an upstream exists. Pushing can publish code and transcripts to a remote repository.
Medium
SKILL.md:81-86
Ruby/shell backtick execution
- If it does not and a default remote exists, run `git push -u origin HEAD`.
The skill instructs git push -u origin HEAD when no upstream exists. This can publish a branch and its transcript to a remote.
Medium
SKILL.md:88
Ruby/shell backtick execution
Without an anchor, `export_codex_session.py` selects the newest Codex JSONL session whose `session_m
The fallback selection uses the newest session matching the repository cwd when no anchor is used. That can select the wrong session and expose unintended transcript content.
Medium
SKILL.md:42-49
Template literal with command substitution
```bash
The command block combines current-directory expansion with transcript export. The expansion is safe, but the overall command processes sensitive session data.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
README.md:3README.md:70-78SKILL.md:10-12SKILL.md:79-82
AI Session Transcript Publication Risk
The skill is designed to export Codex session content, commit it with code changes, and push the branch. Even redacted transcripts can expose prompts, commands, local paths, and sensitive project context.
The README and SKILL.md both describe exporting Codex sessions and pushing commits. The files also acknowledge that raw sessions and command output can contain sensitive material.
RISK-002 Medium
README.md:53-58README.md:80-91SKILL.md:42-48SKILL.md:92-93
Referenced Redaction Exporter Is Not Reviewable
The workflow depends on export_codex_session.py for transcript creation and redaction, but the scanned package contains no script file. This makes the advertised redaction behavior unverifiable from the reviewed files.
The reviewed file set contains README.md, SKILL.md, and .gitignore only, while both docs reference an exporter script. The risk is confidence-limited because the script may exist outside the scanned package.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Codex session transcripts may expose sensitive prompts, commands, paths, or project context.
    Require explicit user approval after showing the transcript path, target remote, staged files, and secret scan result.
  2. FIX-002
    High
    The workflow allows raw Codex JSONL logs to be committed after a warning.
    Remove raw JSONL commits from the workflow or require a separate explicit confirmation for private repositories only.
  3. FIX-003
    Medium
    The redaction exporter referenced by the skill is not present in the scanned files.
    Ship the exporter with the skill and include tests that prove system messages, secrets, and raw logs are omitted.
  4. FIX-004
    Medium
    Push steps can publish transcript content to a remote repository.
    Stop before git push unless the user confirms the remote, branch, transcript review, and staged diff.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable