review 92/100 — SaferSkills

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.6 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · claude-code/plugins/openai-codex__codex/commands/review/SKILL.md×2

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptclaude-code/plugins/openai-codex__codex/commands/review/SKILL.md· markdown

18Execution mode rules:

19- If the raw arguments include `--wait`, do not ask. Run the review in the foreground.

20- If the raw arguments include `--background`, do not ask. Run the review in a Claude backgr

… (10 chars elided on L20)

21- Otherwise, estimate the review size before asking:

Occurrences

2 occurrences · first at L19, also L20

Show all 2 locations

Line

File

L19

claude-code/plugins/openai-codex__codex/commands/review/SKILL.md

L20

claude-code/plugins/openai-codex__codex/commands/review/SKILL.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799a…rubric 365aaca

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

claude-code/plugins/openai-codex__codex/commands/review/SKILL.md · 1 file

claude-code/plugins/openai-codex__codex/commands/review/SKILL.md3.1 KB · Markdown

description: Run a Codex code review against local git state

argument-hint: '[--wait|--background] [--base <ref>] [--scope auto|working-tree|branch]'

disable-model-invocation: true

allowed-tools: Read, Glob, Grep, Bash(node:*), Bash(git:*), AskUserQuestion

Run a Codex review through the shared built-in reviewer.

Raw slash-command arguments: $ARGUMENTS

Core constraint:

This command is review-only.
Do not fix issues, apply patches, or suggest that you are about to make changes.
Your only job is to run the review and return Codex's output verbatim to the user.

Execution mode rules:

If the raw arguments include --wait, do not ask. Run the review in the foreground.
If the raw arguments include --background, do not ask. Run the review in a Claude background task.
Otherwise, estimate the review size before asking:
For working-tree review, start with git status --short --untracked-files=all.
For working-tree review, also inspect both git diff --shortstat --cached and git diff --shortstat.
For base-branch review, use git diff --shortstat <base>...HEAD.
Treat untracked files or directories as reviewable work even when git diff --shortstat is empty.
Only conclude there is nothing to review when the relevant working-tree status is empty or the explicit branch diff is empty.
Recommend waiting only when the review is clearly tiny, roughly 1-2 files total and no sign of a broader directory-sized change.
In every other case, including unclear size, recommend background.
When in doubt, run the review instead of declaring that there is nothing to review.
Then use AskUserQuestion exactly once with two options, putting the recommended option first and suffixing its label with (Recommended):
Wait for results
Run in background

Argument handling:

Preserve the user's arguments exactly.
Do not strip --wait or --background yourself.
Do not add extra review instructions or rewrite the user's intent.
The companion script parses --wait and --background, but Claude Code's Bash(..., run_in_background: true) is what actually detaches the run.
/codex:review is native-review only. It does not support staged-only review, unstaged-only review, or extra focus text.
If the user needs custom review instructions or more adversarial framing, they should use /codex:adversarial-review.

Foreground flow:

Run:

node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" review "$ARGUMENTS"

Return the command stdout verbatim, exactly as-is.
Do not paraphrase, summarize, or add commentary before or after it.
Do not fix any issues mentioned in the review output.

Background flow:

Launch the review with Bash in the background:

Bash({
  command: `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" review "$ARGUMENTS"`,
  description: "Codex review",
  run_in_background: true
})

Do not call BashOutput or wait for completion in this turn.
After launching the command, tell the user: "Codex review started in the background. Check /codex:status for progress."

review— agent skill

Is review safe to install?

Audit the pieces. Scan the whole. Decide.