Security risk report for @forgecat/openai_codex-plugin-cc_codex v0.1.4
Source Integrity
Low
Profile is sourced from OpenAI's official Codex plugin repository (https://github.com/openai/codex-plugin-cc/tree/main/plugins/codex) with documented commit hash.
Declared as Apache-2.0 licensed and marked as original source material.
No typosquatted, attacker-controlled, or suspicious package dependencies introduced in the markdown or command definitions.
Agent Intent
Low
Content describes legitimate code review, task delegation, and session management workflows without instructing the AI to ignore its instructions, leak system prompts, or exfiltrate credentials.
Skill definitions (codex-cli-runtime, gpt-5-4-prompting, codex-result-handling) provide operational guidance for composing Codex prompts and forwarding output—standard practice, not poisoning.
No malicious knowledge planted; prompt-composition guidance emphasizes verification loops, grounding rules, and safety constraints rather than weakening security defaults.
Details
Evidence
codex-rescue.md: 'Your only job is to forward the user's rescue request to the Codex companion script. Do not do anything else.'
codex-result-handling/SKILL.md: 'CRITICAL: After presenting review findings, STOP. Do not make any code changes. Do not fix any issues. You MUST explicitly ask the user which issues, if any, they want fixed before touching a single file.'
gpt-5-4-prompting/references/prompt-blocks.md includes action_safety, verification_loop, and grounding_rules blocks—all defensive.
Permissions
PRM-003Medium
Several commands use `Bash(node:*)` and `Bash(git:*)` scoped tool calls, which is appropriate for the stated purpose of invoking a local Codex companion script and inspecting git state.
The static scanner flagged three hook scripts (session-start.sh, session-end.sh, stop-review-gate.sh) that have no matching tool declarations in the profile — these hooks could execute shell code outside the declared allowed-tools scope, representing authority slightly broader than what is explicitly stated.
The `codex-rescue` agent is granted the general `Bash` tool (unscoped) rather than the narrower `Bash(node:*)` pattern used by commands, which is modestly broader than strictly necessary for a thin forwarding wrapper.
ForgeCat