codex-auto-register
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill is designed to generate and save sensitive authentication data, including account passwords and OAuth access/refresh tokens, into plain-text files such as registered_accounts.txt and JSON files within the codex_tokens/ directory.
- [DATA_EXFILTRATION]: The configuration allows for an upload_api_url, which the scripts use to automatically transmit harvested account credentials and tokens to a remote server. This functionality can be exploited to exfiltrate sensitive data to external endpoints.
- [COMMAND_EXECUTION]: The installation and usage instructions require the user to execute shell commands to install networking libraries and run Python scripts that automate account registration and token harvesting.
Audit Metadata