codex-in-app-browser
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read an external file located at ~/.codex/plugins/cache/openai-bundled/browser//skills/control-in-app-browser/SKILL.md and treat its content as authoritative. This exposes the agent to instructions contained in external data files that may not be under the same security controls as the skill itself. Evidence Chain: 1. Ingestion points: ~/.codex/plugins/cache/openai-bundled/browser//skills/control-in-app-browser/SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: mcp__node_repl__js (arbitrary JS execution and file access). 4. Sanitization: Absent.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic JavaScript imports (await import('/scripts/browser-client.mjs')) where the file path is determined by the agent at runtime. This allows for the loading and execution of code from computed or variable file system paths, which can be manipulated to load malicious scripts.
- [COMMAND_EXECUTION]: The skill operates by sending arbitrary JavaScript code directly to the mcp__node_repl__js tool. This execution environment provides powerful system access that could be abused if the agent's instructions are influenced by untrusted external content or if the runtime environment is not properly restricted.
Audit Metadata