中文 EN
Start Review
Skill Trust Decision

codexbox

纯文档型skill包，声明功能与文档内容一致，Docker容器化的OpenAI Codex CLI工具，所有风险在文档中有明确警告。

Install decision first Source: ClawHub Scanned: Sep 13, 2026
Files 3
Artifacts 3
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

3 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

Dependency information is incomplete, so supply-chain confidence stays limited.

What drove the risk score up

默认无认证端点暴露 +10

API/MCP端点默认无认证，文档已有警告但实际风险取决于用户配置

远程脚本安装风险 +10

curl|bash管道安装已被文档标记为风险，建议先审查再执行

文件删除不可逆 +5

文档明确警告文件删除无撤销功能

Most important evidence

Medium Priv Escalation

默认无认证暴露敏感操作

CODEXBOX_API_MODE_TOKEN 和 CODEXBOX_MCP_MODE_TOKEN 默认空值，导致API和MCP端点完全无认证，任何能访问端口的人可执行代码和操作文件

SKILL.md:1
部署时必须设置强认证令牌，绑定到localhost或置于认证代理之后
Medium Supply Chain

远程脚本安装风险

一键安装脚本使用 curl|bash 管道执行远程代码，文档虽已警告但仍可能被用户忽视直接执行

SKILL.md:1
始终使用 curl -o install.sh 下载 → less install.sh 审查 → bash install.sh 执行
Low Sensitive Access

工作区挂载当前目录

默认挂载 $PWD 为工作区，可能暴露敏感项目文件给codex执行

SKILL.md:1
使用专用隔离目录作为工作区，避免挂载包含敏感文件的主目录

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
SKILL.md 描述文件上传/下载/删除功能
Shell Pass
Declared WRITE
→
Inferred WRITE
通过 codex CLI 执行命令
Network Pass
Declared WRITE
→
Inferred WRITE
REST API、OpenAI兼容端点、MCP服务器、Telegram

Suspicious artifacts and egress

Medium External URL
http://host:8080/openai/v1

SKILL.md:135

Medium External URL
https://clawhub.ai/user/psyb0t

skill-card.md:9

Medium External URL
https://clawhub.ai/psyb0t/skills/codexbox

skill-card.md:43

Dependencies and supply chain

There are no structured dependency warnings.

File composition

3 files · 577 lines
Markdown 3 files · 577 lines
Files of concern · 2
SKILL.md Markdown · 312 lines
默认无认证暴露敏感操作 · 远程脚本安装风险 · 工作区挂载当前目录 · http://host:8080/openai/v1
skill-card.md Markdown · 64 lines
https://clawhub.ai/user/psyb0t · https://clawhub.ai/psyb0t/skills/codexbox
Other files · setup.md

Security positives

文档完整清晰，所有风险在文档中有明确警告
安全设计合理（独立的双认证层、文件路径遍历检查）
代码执行为Docker容器化，隔离性好
文件操作有明确范围限制（workspace root）
支持 ChatGPT 订阅认证方式避免API密钥暴露