codex-review-backlog
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script located at
scripts/agent-identity.shto generate identity headers. It also uses the GitHub CLI (gh) andgitfor repository management, including potentially destructive operations likegit reset --hard. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it ingests and acts upon external data from GitHub PR comments.
- Ingestion points: Reads PR comments and review summaries using
gh api repos/{owner}/{repo}/pulls/<n>/commentsandreviews. - Boundary markers: None explicitly defined in the instructions to separate external comment content from agent instructions.
- Capability inventory: Performs
git reset,git push,gh apicalls to create/update PRs and comments, and executesbash scripts/agent-identity.sh. - Sanitization: No specific sanitization or validation of the comment content is mentioned before it influences the triage and fix process.
Audit Metadata