Skill Trust Decision
codexbox
纯文档型skill包，声明功能与文档内容一致，Docker容器化的OpenAI Codex CLI工具，所有风险在文档中有明确警告。
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
默认无认证端点暴露 +10
API/MCP端点默认无认证，文档已有警告但实际风险取决于用户配置
远程脚本安装风险 +10
curl|bash管道安装已被文档标记为风险，建议先审查再执行
文件删除不可逆 +5
文档明确警告文件删除无撤销功能
Most important evidence
Medium Priv Escalation
默认无认证暴露敏感操作
CODEXBOX_API_MODE_TOKEN 和 CODEXBOX_MCP_MODE_TOKEN 默认空值，导致API和MCP端点完全无认证，任何能访问端口的人可执行代码和操作文件
SKILL.md:1 部署时必须设置强认证令牌，绑定到localhost或置于认证代理之后
Medium Supply Chain
远程脚本安装风险
一键安装脚本使用 curl|bash 管道执行远程代码，文档虽已警告但仍可能被用户忽视直接执行
SKILL.md:1 始终使用 curl -o install.sh 下载 → less install.sh 审查 → bash install.sh 执行
Low Sensitive Access
工作区挂载当前目录
默认挂载 $PWD 为工作区，可能暴露敏感项目文件给codex执行
SKILL.md:1 使用专用隔离目录作为工作区，避免挂载包含敏感文件的主目录
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
SKILL.md 描述文件上传/下载/删除功能 Shell Pass
Declared WRITE
→ Inferred WRITE
通过 codex CLI 执行命令 Network Pass
Declared WRITE
→ Inferred WRITE
REST API、OpenAI兼容端点、MCP服务器、Telegram Suspicious artifacts and egress
Medium External URL
http://host:8080/openai/v1 SKILL.md:135
Medium External URL
https://clawhub.ai/user/psyb0t skill-card.md:9
Medium External URL
https://clawhub.ai/psyb0t/skills/codexbox skill-card.md:43
Dependencies and supply chain
There are no structured dependency warnings.
File composition
3 files · 577 lines
Markdown 3 files · 577 lines
Files of concern · 2
SKILL.md 默认无认证暴露敏感操作 · 远程脚本安装风险 · 工作区挂载当前目录 · http://host:8080/openai/v1
skill-card.md https://clawhub.ai/user/psyb0t · https://clawhub.ai/psyb0t/skills/codexbox
Other files · setup.md
Security positives
文档完整清晰，所有风险在文档中有明确警告
安全设计合理（独立的双认证层、文件路径遍历检查）
代码执行为Docker容器化，隔离性好
文件操作有明确范围限制（workspace root）
支持 ChatGPT 订阅认证方式避免API密钥暴露