codex-issue-runner
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
- Ingestion points: The skill reads external content from GitHub issues and pull requests using 'gh issue view' and 'gh pr view' commands within the SKILL.md workflow.
- Boundary markers: No delimiters or 'ignore embedded instructions' warnings are present when providing this retrieved data to the Codex agent.
- Capability inventory: The skill has significant capabilities including terminal access via iTerm tool calls, git operations, and the Codex CLI which can modify local files and interact with GitHub via the gh CLI as described in SKILL.md.
- Sanitization: There is no evidence of sanitization or filtering of the content retrieved from GitHub before it is processed by the AI agent.
- [COMMAND_EXECUTION]: Executes local shell commands and custom aliases.
- The skill instructs the agent to run 'gitcm' (a custom git alias), 'codex', and 'www' (a custom workflow script) as seen in Step 2, Step 3, and the 'After Codex Finishes' section of SKILL.md.
- It performs file system operations by navigating to specific hardcoded local paths like '~/Development/SpeakMCP-Workspaces/slot-N'.
Audit Metadata