Audit History

Automatic Approval of Model Actions

The Codex cookbook recommends `codex --full-auto` and relies on a brief sandbox warning. Auto-approval can permit unintended file, process, or network actions within the configured sandbox.

The command and its auto-approval behavior are explicit. The warning reduces misuse risk but does not require confirmation or define sandbox restrictions.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Shell command substitution

$(find src -name '*.ts' -exec cat {} \;)

The command reads every matching TypeScript file and submits the contents to Gemini. This can disclose proprietary code or embedded secrets to a cloud provider.

Medium

Shell command substitution

$(cat implementation-a.ts)

The command reads a local implementation file into a Gemini prompt. The fixed filename prevents command injection, but cloud disclosure remains possible.

Medium

reference/model-selection.md:182

Shell command substitution

$(cat implementation-b.ts)

The command reads a second local implementation file into a Gemini prompt. The fixed filename prevents command injection, but cloud disclosure remains possible.

Low

Hardcoded URL

prompt: "Fetch https://docs.viperjuice.dev",

The sample explicitly delegates retrieval from a fixed external domain. This exposes the agent to untrusted remote content, although no credentials or private data are sent.

Risk Factors

⚙️ External commands (35)

🔑 Env variables (11)

cookbook/gemini-cli.md:24 cookbook/openai-codex.md:23 cookbook/openai-codex.md:25 reference/provider-matrix.md:110 reference/provider-matrix.md:120 reference/provider-matrix.md:121 reference/provider-matrix.md:122 reference/provider-matrix.md:123 reference/provider-matrix.md:124 SKILL.md:86 SKILL.md:91

🌐 Network access (6)

cookbook/ollama-local.md:24 cookbook/ollama-local.md:60 cookbook/ollama-local.md:71 cookbook/ollama-local.md:125 cookbook/parallel-execution.md:194 reference/model-selection.md:182

Audited by: codex

Audit version 11

2026年7月13日下午04:30

Files scanned

1,467

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

Automatic Approval of Model Actions

The Codex cookbook recommends `codex --full-auto` and relies on a brief sandbox warning. Auto-approval can permit unintended file, process, or network actions within the configured sandbox.

The command and its auto-approval behavior are explicit. The warning reduces misuse risk but does not require confirmation or define sandbox restrictions.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Shell command substitution

$(find src -name '*.ts' -exec cat {} \;)

The command reads every matching TypeScript file and submits the contents to Gemini. This can disclose proprietary code or embedded secrets to a cloud provider.

Medium

Shell command substitution

$(cat implementation-a.ts)

The command reads a local implementation file into a Gemini prompt. The fixed filename prevents command injection, but cloud disclosure remains possible.

Medium

reference/model-selection.md:182

Shell command substitution

$(cat implementation-b.ts)

The command reads a second local implementation file into a Gemini prompt. The fixed filename prevents command injection, but cloud disclosure remains possible.

Low

Hardcoded URL

prompt: "Fetch https://docs.viperjuice.dev",

The sample explicitly delegates retrieval from a fixed external domain. This exposes the agent to untrusted remote content, although no credentials or private data are sent.

Risk Factors

⚙️ External commands (35)

🔑 Env variables (11)

🌐 Network access (6)

cookbook/ollama-local.md:24 cookbook/ollama-local.md:60 cookbook/ollama-local.md:71 cookbook/ollama-local.md:125 cookbook/parallel-execution.md:194 reference/model-selection.md:182

Audited by: codex

Audit version 10

2026年7月9日上午01:39

Most static findings are Markdown examples, placeholder API key names, or localhost development URLs. The remaining confirmed risk comes from intentional provider orchestration: local files can be expanded into cloud model prompts, and the skill documents external command delegation paths.

Files scanned

1,467

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:55-64 cookbook/gemini-cli.md:91-98 cookbook/gemini-cli.md:118-128

Cloud Delegation Can Expose Sensitive Source Code

The skill warns not to send sensitive data without consent, but Gemini examples include reading local source files into prompts for a cloud provider. Users need stronger scoping and consent guidance before cloud delegation.

The documentation explicitly recognizes sensitive-data risk and also gives examples that bulk-read local files into Gemini prompts. This is intended functionality rather than malware, so severity is medium.

Medium

Auto-Approval Mode Requires Stronger Guardrails

The Codex cookbook documents full auto-approval mode and only says to use it in sandboxed environments. If copied into a non-sandboxed workflow, it can approve unintended commands without user review.

The line documents a powerful auto-approval flag and includes a warning, but the guardrail is brief. The risk depends on user environment, so confidence is high enough to keep as a medium finding.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Shell command substitution

$(find src -name '*.ts' -exec cat {} \;)

The example expands and sends all matching TypeScript files to Gemini, a cloud provider. This can disclose source code and inject untrusted file content into the prompt.

Medium

Shell command substitution

$(cat implementation-a.ts)

The example reads a local implementation file into a Gemini prompt. It is intentional delegation, but it can disclose local source to an external provider.

Medium

cookbook/ollama-local.md:24 cookbook/ollama-local.md:60 cookbook/ollama-local.md:71 cookbook/ollama-local.md:125 cookbook/parallel-execution.md:194 reference/model-selection.md:182

Shell command substitution

$(cat implementation-b.ts)

The example reads a second local implementation file into a Gemini prompt. It is intentional delegation, but it can disclose local source to an external provider.

Medium

SKILL.md:85-86

Ruby/shell backtick execution

- THEN: Read and execute `cookbook/openai-codex.md`

The instruction tells the assistant to read and execute the OpenAI/Codex cookbook. That cookbook contains external command patterns and provider delegation steps.

Medium

SKILL.md:90-91

Ruby/shell backtick execution

- THEN: Read and execute `cookbook/gemini-cli.md`

The instruction tells the assistant to read and execute the Gemini cookbook. That cookbook includes cloud delegation commands that may send local files externally.

Medium

SKILL.md:95-100

Ruby/shell backtick execution

- THEN: Read and execute `cookbook/cursor-agent.md`

The instruction routes execution to the Cursor cookbook. This is intended functionality, but it still delegates actions to an external tool.

Medium

SKILL.md:100-105

Ruby/shell backtick execution

- THEN: Read and execute `cookbook/opencode-cli.md`

The instruction routes execution to the OpenCode cookbook. This is intended functionality, but it still delegates actions to an external command-line tool.

Medium

SKILL.md:105-112

Ruby/shell backtick execution

- THEN: Read and execute `cookbook/ollama-local.md`

The instruction routes execution to the Ollama cookbook. Ollama is local, but the workflow still asks the assistant to execute external commands.

Medium

SKILL.md:137-154

Ruby/shell backtick execution

```bash

The referenced block lists direct orchestration scripts for provider execution. These commands run local scripts and pass task text into external provider adapters.

Risk Factors

⚙️ External commands (35)

🔑 Env variables (11)

🌐 Network access (6)

Audited by: claude

Audit version 9

2026年7月5日上午06:18

Most static findings are documentation examples, API key placeholders, local URLs, or Markdown fences rather than active malicious code. The real concerns are examples that send local source content to Gemini and workflow guidance that can delegate user data or run full-auto provider commands without a hard consent gate.

Files scanned

1,467

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:57-64 SKILL.md:68-73 reference/provider-matrix.md:146-153

Auto-Approval Execution Mode

The Codex cookbook recommends full-auto execution, which can approve provider actions without step-by-step review if used outside a strong sandbox.

The command and warning are present in the same section, and the sample full-auto command does not include an explicit sandbox flag. The documented warning reduces but does not remove the operational risk.

Medium

Missing Consent Gate Before External Delegation

The workflow warns against sending sensitive data without consent, but the execution steps do not require explicit user approval before delegating context to cloud providers.

The relevant lines explicitly discuss provider delegation and sensitive data, but the checklist only confirms authentication before execution. This makes the risk contextual rather than evidence of malicious intent.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Shell command substitution

$(find src -name '*.ts' -exec cat {} \;)

The command substitution reads every matching TypeScript file and embeds the content in a Gemini prompt. This is intended, but it can disclose proprietary source to a third-party provider without a separate consent gate.

Medium

Shell command substitution

$(cat implementation-a.ts)

The example uses command substitution to insert a local implementation file into a Gemini prompt. That can expose local code to an external provider if copied without review.

Medium

cookbook/openai-codex.md:113

Shell command substitution

$(cat implementation-b.ts)

The example sends another local implementation file through shell substitution into Gemini. This is useful for comparison, but it remains a data-disclosure risk for sensitive code.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

Python pickle deserialization (RCE risk)

data = pickle.loads(user_input)

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

Risk Factors

⚙️ External commands (35)

🔑 Env variables (11)

🌐 Network access (6)

cookbook/ollama-local.md:24 cookbook/ollama-local.md:60 cookbook/ollama-local.md:71 cookbook/ollama-local.md:125 cookbook/parallel-execution.md:194 reference/model-selection.md:182

Audited by: codex

Audit version 8

2026年7月5日上午06:18

Files scanned

1,467

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:57-64 SKILL.md:68-73 reference/provider-matrix.md:146-153

Auto-Approval Execution Mode

The Codex cookbook recommends full-auto execution, which can approve provider actions without step-by-step review if used outside a strong sandbox.

Medium

Missing Consent Gate Before External Delegation

The workflow warns against sending sensitive data without consent, but the execution steps do not require explicit user approval before delegating context to cloud providers.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Shell command substitution

$(find src -name '*.ts' -exec cat {} \;)

Medium

Shell command substitution

$(cat implementation-a.ts)

The example uses command substitution to insert a local implementation file into a Gemini prompt. That can expose local code to an external provider if copied without review.

Medium

cookbook/openai-codex.md:113

Shell command substitution

$(cat implementation-b.ts)

The example sends another local implementation file through shell substitution into Gemini. This is useful for comparison, but it remains a data-disclosure risk for sensitive code.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Critical

Python pickle deserialization (RCE risk)

data = pickle.loads(user_input)

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

Risk Factors

⚙️ External commands (35)

🔑 Env variables (11)

🌐 Network access (6)

cookbook/ollama-local.md:24 cookbook/ollama-local.md:60 cookbook/ollama-local.md:71 cookbook/ollama-local.md:125 cookbook/parallel-execution.md:194 reference/model-selection.md:182

Audited by: codex

Audit version 7

2026年6月29日上午12:57

Static analysis flagged many command, network, environment, and heuristic patterns. Review found these are Markdown instructions and examples, not hidden executable skill code, but the skill does guide users to run provider CLIs, use API keys, and send local content to AI providers. No prompt injection attempt or confirmed malicious intent was found.

Files scanned

1,467

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Medium

SKILL.md:137-153 cookbook/openai-codex.md:39-63 cookbook/cursor-agent.md:31-44 cookbook/gemini-cli.md:59-77 cookbook/ollama-local.md:17-24

Documented External Command Execution

TRUE_POSITIVE: The skill tells users to run provider CLIs and local orchestration commands. This is intended guidance, not hidden execution, but it can modify files, spend credits, or run provider-side actions if followed without review.

The referenced lines are explicit shell and CLI examples. The context shows legitimate user-invoked orchestration guidance rather than stealthy execution.

Medium

cookbook/gemini-cli.md:93-97 cookbook/gemini-cli.md:120-128 cookbook/ollama-local.md:96-102 cookbook/ollama-local.md:122-130

Examples Can Forward Local File Contents to AI Providers

TRUE_POSITIVE: Several examples embed file contents into prompts using command substitution. This is useful for analysis, but cloud providers may receive private source code or documents if users run the examples unchanged.

The examples directly read files into prompts. Gemini is a cloud provider, while Ollama is local, so the risk depends on the selected provider.

Medium