The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/rust/Cargo.lock file includes tampered dependency trees for standard libraries. For instance, serde_json (version 1.0.151) is listed with non-existent dependencies zmij and serde_core. These are not part of the official crate and appear to be malicious injections.\n- [REMOTE_CODE_EXECUTION]: Numerous crates in the lockfile use version numbers that exceed current official releases (e.g., wasm-bindgen at 0.2.127, clap at 4.6.6, anyhow at 1.0.104). This is a characteristic sign of dependency confusion or supply chain compromise intended to ensure the malicious versions are preferred by the package manager.\n- [COMMAND_EXECUTION]: The shell launcher script scripts/report_codex_usage invokes cargo build --locked --release. The --locked flag mandates the use of the provided Cargo.lock file, which will result in the download and execution of the suspicious dependencies during the compilation phase.\n- [DATA_EXFILTRATION]: The skill is designed to read sensitive local data from ~/.codex/, including project assignments and session history. Given the compromised build environment, there is a significant risk that this data could be exfiltrated to a remote server during the build or execution process.\n- [COMMAND_EXECUTION]: Both the Rust and Python implementations use subprocess calls to execute system commands like scutil and hostname. While these specific commands are used to identify the host machine, the underlying execution mechanism could be abused if combined with the compromised dependency chain.

report-codex-usage