codex-app-transfer-proxy
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to download and execute binary releases (EXE, DMG, DEB, AppImage) from an untrusted GitHub repository (github.com/Cmochance/codex-app-transfer).\n
- [DATA_EXFILTRATION]: The skill documentation describes accessing and modifying sensitive agent configuration files, including credentials and auth tokens.\n
- Evidence: The application auto-patches ~/.codex/config.toml and ~/.codex/auth.json to route traffic through the local proxy.\n
- Evidence: Local session data is stored in a SQLite database (sessions.db) at ~/.codex-app-transfer/.\n
- [COMMAND_EXECUTION]: The skill provides instructions for building the proxy application from source, which involves executing shell commands to clone repositories and compile code.\n
- Evidence: Instructions for git clone and cargo tauri build bundles.\n
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a protocol translator between third-party LLMs and the agent, creating a vulnerability surface where untrusted provider responses are injected into the agent's internal context.\n
- Ingestion points: Translated responses from external providers (DeepSeek, Kimi, Gemini, Claude) via the /responses adapter.\n
- Boundary markers: None identified in the protocol translation description.\n
- Capability inventory: High-privilege access to agent config files, memory files (MEMORY.md), and agent definitions (AGENTS.md).\n
- Sanitization: No sanitization of external LLM output is described before injection into the Codex protocol stream.
Recommendations
- AI detected serious security threats
Audit Metadata