codex-review

SUSPICIOUS. The skill’s core purpose is coherent, and the implied Codex dependency appears to be an official same-org tool, so this is not confirmed malware. The main risk is the mandatory use of sandbox-disabled Bash to run unseen local wrapper scripts that can access repo data and potentially broader local state before forwarding content to an external AI service.

The hook implements a coherent session-bound plan-review gate and contains no visible network exfiltration, credential theft, reverse shell, or destructive malware. However, sourcing a repository-controlled config.env grants that file arbitrary shell execution whenever the hook runs, making this unsafe in untrusted repositories and a significant supply-chain risk. The predictable temporary file and writable verdict/state files also permit local tampering or races. The code should parse configuration without execution and use securely created temporary files and protected state files.