codexdesktop-rebuild-electron
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an external GitHub account (
https://github.com/Haleclipse/CodexDesktop-Rebuild.git) and install its dependencies vianpm install. - [COMMAND_EXECUTION]: The provided code snippets demonstrate an Electron Inter-Process Communication (IPC) handler named
execute-codex-commandthat executes CLI commands. Without proper validation, this pattern can be vulnerable to command injection. - [PROMPT_INJECTION]: The skill implements an interface that takes user input from a textarea and passes it to an execution handler, creating a surface for indirect prompt injection. Ingestion point:
src/webview/main.js. Capability inventory:ipcMain.handleinmain.js. Boundary markers: None present. Sanitization: Not provided in documentation snippets.
Audit Metadata