codex-hygiene-skill
Fail
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an unverified third-party source:
https://github.com/sunflower-of-parchman/codex-hygiene.git. - [REMOTE_CODE_EXECUTION]: The skill executes shell scripts, specifically
measure_codex_context.sh, which are downloaded from the external repository. These scripts run with user privileges and perform arbitrary commands on the system. - [COMMAND_EXECUTION]: The instructions recommend modifying shell initialization files (
.bashrcand.zshrc) to include a function that executes the skill's scripts. It also suggests creating git pre-push hooks (.git/hooks/pre-push), establishing a persistence mechanism that triggers the script during regular developer workflows. - [DATA_EXFILTRATION]: The skill accesses sensitive local application data by querying the Codex Desktop telemetry database (
~/.codex/telemetry.db) and reading the configuration file (~/.codex/config.toml). This exposes metadata about user interactions, thread history, and active tool/server integrations. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes interaction history from the telemetry database. Malicious instructions embedded in past thread data could be re-injected into the agent's context during the 'hygiene' audit.
Recommendations
- AI detected serious security threats
Audit Metadata