codex-orchestration-multi-model
Warn
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a plugin from an untrusted GitHub repository (
Cjbuilds/Codex-Orchestration). Installing executable plugins from unverified third-party sources poses a risk of supply chain attacks. - [PROMPT_INJECTION]: The orchestration workflow (Planner -> Advisor -> Executor) creates an attack surface for indirect prompt injection. A malicious plan generated by the Planner or influenced by task input could potentially manipulate the Advisor's review or the Executor's implementation phase.
- Ingestion points: Implementation plans are passed between models within the orchestration workflow described in
SKILL.md. - Boundary markers: No explicit boundaries or instructions to ignore embedded commands are present in the role definitions.
- Capability inventory: The 'Executor' role is defined to implement code, which involves file system access and command execution (e.g., via the Codex Goal system).
- Sanitization: There is no evidence of sanitization or filtering of the content passed between roles.
- [COMMAND_EXECUTION]: The installation and troubleshooting sections involve shell commands that modify the agent's plugin environment and configuration files (e.g.,
.codex/agents/). While these are intended for setup, they provide a mechanism for modifying the agent's behavior at a system level.
Audit Metadata