codex-computer-use
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read a local file (
~/.codex/plugins/cache/openai-bundled/computer-use/<version>/skills/computer-use/SKILL.md) and treat its content as authoritative instructions. - Ingestion points: The agent reads external markdown content from the local filesystem into its active context (SKILL.md).
- Boundary markers: There are no instructions to use delimiters or ignore potentially malicious instructions embedded in the cached file.
- Capability inventory: The skill utilizes the
mcp__node_repl__jstool for code execution and provides UI interaction capabilities (clicking, typing, screenshots) through the@oai/skyruntime. - Sanitization: The skill does not implement validation or sanitization of the content fetched from the local cache directory.
- [DYNAMIC_EXECUTION]: The skill employs dynamic JavaScript loading via
await import("@oai/sky")within a REPL environment to initialize its core functionality.
Audit Metadata