codex-auth
Manages OpenAI Codex CLI authentication, enabling seamless access and multi-account management for developers.
Install this skill
Security score
The codex-auth skill was audited on Feb 9, 2026 and we found 26 security issues across 5 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 260 | ```yaml |
Template literal with variable interpolation in command context
| 444 | ```bash |
Curl to non-GitHub URL
| 381 | curl https://api.openai.com/v1/models \ |
Curl to non-GitHub URL
| 390 | curl -I https://api.openai.com/v1/models \ |
Access to hidden dotfiles in home directory
| 52 | mkdir -p ~/.codex |
Access to hidden dotfiles in home directory
| 53 | cat > ~/.codex/config.toml << 'EOF' |
Access to hidden dotfiles in home directory
| 56 | chmod 600 ~/.codex/config.toml |
Access to hidden dotfiles in home directory
| 72 | 4. User config `~/.codex/config.toml` |
Access to hidden dotfiles in home directory
| 78 | # ~/.codex/config.toml |
Access to hidden dotfiles in home directory
| 310 | # docker run -v ~/.codex:/root/.codex ... |
Access to hidden dotfiles in home directory
| 354 | cat ~/.codex/config.toml |
Access to hidden dotfiles in home directory
| 366 | rm -rf ~/.codex/credentials |
Access to hidden dotfiles in home directory
| 394 | # Set in ~/.codex/config.toml: |
Access to hidden dotfiles in home directory
| 419 | chmod 600 ~/.codex/config.toml |
Access to hidden dotfiles in home directory
| 449 | local log_dir="~/.codex/audit" |
Access to hidden dotfiles in home directory
| 460 | elif [ -f ~/.codex/credentials ]; then |
Access to hidden dotfiles in home directory
| 496 | # ~/.codex/config.toml with multiple profiles (December 2025) |
Access to root home directory
| 310 | # docker run -v ~/.codex:/root/.codex ... |
Access to .env file
| 415 | echo '.env' >> .gitignore |
Access to system keychain/keyring
| 216 | ### Using macOS Keychain |
Access to system keychain/keyring
| 220 | # Store in macOS Keychain |
Access to system keychain/keyring
| 228 | # Retrieve from keychain |
External URL reference
| 381 | curl https://api.openai.com/v1/models \ |
External URL reference
| 384 | # Regenerate key at https://platform.openai.com/api-keys |
External URL reference
| 390 | curl -I https://api.openai.com/v1/models \ |
External URL reference
| 428 | echo "Visit https://platform.openai.com/api-keys to generate new key" |