codex-mcp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The wrapper intentionally disables/relaxes safety controls (spawns Codex with sandbox_mode="danger-full-access" and approval_policy="never"), auto-accepts command/file/permissions requests (with only a narrow regex-based denylist), and executes commands/files on behalf of the model (spawn/execSync and auto-apply diffs), which deliberately enables remote model-driven command execution and file modification — a high-risk design that could be abused as a backdoor even though there is no explicit external exfiltration URL or obfuscated payload in the code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's documented "research" mode explicitly tells Codex to "use web search" and return sources/URLs (see SKILL.md and the ROLE_PREFIX.research text in scripts/codex-mcp-server.mjs), so the agent/toolchain ingests and acts on untrusted public web content that can influence subsequent actions.