codex-delegate
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using the
node:child_processmodule within itsrelay.mjsscript. It runscodex --versionto verify the installation,git status --porcelainto identify changed files, andcodex exec(orcodex exec resume) to process coding tasks. These operations are performed usingspawnandexecFileSyncwith explicitly constructed argument arrays, which prevents shell-based command injection. - [EXTERNAL_DOWNLOADS]: The documentation instructs the agent to ensure the
@openai/codexpackage is installed via npm (npm i -g @openai/codex). This is a standard dependency installation from a well-known service provider and is essential for the skill's stated purpose of delegating work to the Codex CLI.
Audit Metadata