registry / codex-channel-bgos / 0.2.1

codex-channel-bgos@0.2.1

BGOS channel adapter for OpenAI Codex: pair, WS + REST client, Codex SDK host, outbound modalities, one-paste connect

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-started paired daemon forwards BGOS messages to a Codex SDK agent. On connection it can replace its own workspace AGENTS.md with backend-provided capability text.

Static reason

No blocking static signals were detected.

Trigger

User runs connect/start; persistence additionally requires install-service.

Impact

A compromised paired backend/account could influence agent tool and workspace actions without per-action approval.

Mechanism

Remote BGOS input and capability text drive a workspace-write Codex agent.

Rationale

No concrete malware or unconsented install-time control-surface mutation was found. The remote instruction path and unapproved workspace-write agent warrant a warning for dangerous capability exposure.

Evidence

package.jsondist/cli.jsdist/adapter.jsdist/codex-host.jsdist/bgos-api.jsdist/install-service.jsdist/attachment-bridge.js~/.codex-bgos/secrets/bgos.json~/.codex-bgos/workspace/AGENTS.md~/Library/LaunchAgents/ai.brandgrowthos.codex-bgos.plist~/.config/systemd/user/codex-bgos.service

Network endpoints2

api.brandgrowthos.ai/api/v1/socket.io

codex-channel-bgos@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code