codexpro-chatgpt-local-agent
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and instructions for a developer tool designed to facilitate local repository interaction. It includes prominent security notes and configuration options to enforce read-only or restricted access modes.
- [COMMAND_EXECUTION]: The skill describes a 'bash' tool that supports shell command execution. The tool defaults to a 'safe mode' with a restricted allowlist of commands (e.g., git status, npm test) and can be disabled entirely through environment variables.
- [EXTERNAL_DOWNLOADS]: The skill references the 'codexpro' package on the official npm registry and its corresponding source code repository on GitHub for the purpose of installation and reference.
- [DATA_EXFILTRATION]: The guide explains how to use secure tunnels (via ngrok or Cloudflare) to connect a local MCP server to ChatGPT. It emphasizes the use of randomly generated auth tokens and workspace-only access to prevent unauthorized data access.
- [SAFE]: (Indirect Prompt Injection) The skill defines a workflow where an agent ingests and processes repository data. Ingestion points: Local file content and git metadata are read into the agent context via tools such as 'read', 'tree', and 'search'. Boundary markers: The skill does not explicitly define delimiters for untrusted file content in the instructions. Capability inventory: The agent is equipped with file modification tools ('write', 'edit') and a 'bash' execution tool. Sanitization: The underlying tool implements workspace-only file access and a command allowlist to mitigate potential injection attacks from malicious code in processed files.
Audit Metadata