use-windows-vm-computer-use-codex

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill intentionally disables sandboxing (--yolo) and provisions interactive scheduled tasks, encoded PowerShell transport, and silent package installs to run arbitrary Codex prompts in a VM user session—providing a clear remote-code-execution/backdoor surface that could be abused for persistence, privilege escalation, or data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime only via the user-supplied Codex prompt passed as the scheduled task --yolo exec ... "<$prompt>", which then drives the VM-local computer-use agent.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs disabling sandbox protections with "--yolo", installing software (winget AutoHotkey), and creating/running temporary scheduled tasks in the interactive session, all of which modify system state and bypass normal security controls.