codexu-macos-usage-tracker
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Directs users to download executable DMG files and source code from an unverified GitHub repository (
github.com/shanggqm/codexU) which is not identified as a trusted source. - [REMOTE_CODE_EXECUTION]: Provides instructions to clone and install code from an untrusted repository via
make install, which allows for arbitrary code execution on the local machine during the build and installation process. - [PRIVILEGE_ESCALATION]: Includes instructions to bypass macOS security features (Gatekeeper) using the command
xattr -dr com.apple.quarantine. This action removes the quarantine flag that normally triggers security verification for downloaded apps, facilitating the execution of unverified binaries. - [DATA_EXFILTRATION]: The application specifically targets sensitive directories including
~/.codex/and~/.claude/, which store SQLite databases and JSONL files containing private conversation transcripts, session tokens, and account metadata. Granting an unverified binary read access to these locations presents a high risk of sensitive data exposure. - [COMMAND_EXECUTION]: Instructs the user to run various shell commands (
make build,make install,make probe) that perform operations on the file system and interact with system utilities to install and run third-party software.
Recommendations
- AI detected serious security threats
Audit Metadata