dispatching-codex-gpt
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@openai/codexpackage globally via NPM. This package is hosted under the@openaiscope, which belongs to a trusted organization. - [COMMAND_EXECUTION]: The setup process involves executing shell commands to install software (
npm i -g @openai/codex) and register an MCP server (claude mcp add gpt-codex ...). - [COMMAND_EXECUTION]: The suggested MCP server configuration includes the flag
approval_policy=never, which allows the sub-agent to perform actions (such as writing to the workspace) without requiring per-action user approval. This is the intended design for autonomous task dispatching. - [SAFE]: The skill documentation explicitly warns the user to review and verify any changes made by the sub-agent before integration, emphasizing that edits should not be merged blindly.
Audit Metadata