## Summary The bundled `spreadsheets` plugin from the OpenAI Primary Runtime emits two skill-metadata warnings on every fresh Codex startup. The warnings are caused by paths in the bundled plugin, not by a user's `config.toml`. ```text WARN codex_core_skills::loader: ignoring interface.icon_small: icon path with '..' must resolve under plugin assets/ WARN codex_core_skills::loader: ignoring interface.icon_large: icon path with '..' must resolve under plugin assets/ ``` ## Environment - Codex

Bundled spreadsheets plugin emits invalid icon path warnings on every startup

Open 💬 2 comments Opened Jul 14, 2026 by procloudkim

Summary

The bundled spreadsheets plugin from the OpenAI Primary Runtime emits two skill-metadata warnings on every fresh Codex startup. The warnings are caused by paths in the bundled plugin, not by a user's config.toml.

WARN codex_core_skills::loader: ignoring interface.icon_small: icon path with '..' must resolve under plugin assets/
WARN codex_core_skills::loader: ignoring interface.icon_large: icon path with '..' must resolve under plugin assets/

Environment

Codex surface: Codex Desktop
Bundled CLI: codex-cli 0.144.2
Platform: Windows x64
Affected plugin: spreadsheets@openai-primary-runtime

Account identifiers, subscription details, and local machine identifiers are intentionally omitted because they are not relevant to this local metadata-validation issue.

Steps to reproduce

Install or enable the bundled spreadsheets@openai-primary-runtime plugin.
Start a fresh Codex process.
Inspect the startup log.
Observe one warning for interface.icon_small and one for interface.icon_large.

No related config.toml setting is required.

Root cause

The plugin metadata at:

skills/excel-live-control/agents/openai.yaml

references a sibling skill's asset:

icon_small: ../spreadsheets/assets/file-spreadsheet.png
icon_large: ../spreadsheets/assets/file-spreadsheet.png

A path containing .. is accepted only when its resolved target remains under the plugin-level assets/ directory. These paths instead resolve into a sibling skill directory, so the loader correctly rejects them and ignores both optional icons.

Expected behavior

Bundled plugin metadata should pass validation and load both icons without warnings.

Verified package fix

I tested the following package-only correction:

Copy the icon to skills/excel-live-control/assets/file-spreadsheet.png.
Change both metadata values to ./assets/file-spreadsheet.png.
Revalidate and reinstall the plugin package.

Results:

official plugin validation passed for both source and installed cache;
source and installed-cache file hashes matched;
two independent fresh Codex starts produced zero target warnings;
excel-live-control remained discoverable;
all five plugins in the same Primary Runtime snapshot passed validation.

Optional loader diagnostic hardening

The package correction is the primary fix. Separately, I prepared and tested a small loader diagnostic improvement that leaves validation behavior unchanged but adds these structured warning fields:

plugin_id
skill_dir
raw_path
resolved_path
allowed_root

The existing invalid plugin-icon regression test was extended to assert those fields.

Local verification:

just fmt: passed
just test -p codex-core-skills: 118 tests passed
git diff --check: passed

I understand that external code contributions to this repository are invitation-only. If maintainers want the diagnostic hardening after reviewing this issue, I can provide the tested patch through the invited contribution workflow.

Privacy note

This report intentionally excludes email addresses, local usernames, absolute home/workspace paths, account and subscription identifiers, thread or run identifiers, authentication material, and unrelated log lines.

View original on GitHub ↗

2 Comments

lightcloud00 · 15 days ago

Still reproducible on macOS — bundled runtime 26.812.11052

The current bundled spreadsheets plugin still contains these values in the Excel Live Control skill metadata:

icon_small: "../spreadsheets/assets/file-spreadsheet.png"
icon_large: "../spreadsheets/assets/file-spreadsheet.png"

On Codex Desktop 26.803.61601 (macOS arm64, bundled CLI 0.147.0-alpha.6.5), the local structured log recorded 384 icon-path validation warnings in the current log window. The repeated stable messages are the same two warnings reported here: interface.icon_small and interface.icon_large are ignored because the .. path does not resolve under the plugin assets root.

The affected bundled spreadsheets plugin version is 26.812.11052. No local paths, task identifiers, or unrelated logs are included.

aidawilliam41-ops · 13 days ago

Still present in the current Windows bundled runtime

The packaged metadata defect remains present in:

Codex Desktop: 26.810.6296.0
Codex CLI: 0.147.0
OpenAI Primary Runtime spreadsheets plugin: 26.813.12317

The unmodified bundled skills/excel-live-control/agents/openai.yaml has SHA-256:

E7DD753D45019AD2196CEF0E2DD866E50BB14832F0653D019D69B0EB4D1A82EA

It still contains exactly two invalid declarations:

icon_small: "../spreadsheets/assets/file-spreadsheet.png"
icon_large: "../spreadsheets/assets/file-spreadsheet.png"

Resolving that relative path from the declaring metadata file points outside the intended skill asset layout to a path that does not exist. A bounded inventory of this bundled plugin snapshot also found no packaged file-spreadsheet.png that could satisfy either declaration.

This confirms that the package-level defect persists in 26.813.12317, independently of whether a particular command eagerly loads the skill and emits the warning during that invocation.

The existing suggested correction remains appropriate: package the icon inside the Excel Live Control skill's allowed asset boundary and reference it without the invalid sibling traversal. Packaging CI should validate all bundled skill metadata before release.

No local cache file was modified. No usernames, absolute local paths, account information, task identifiers, or unrelated logs are included.