codex-subagent
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled task descriptions and repository context, piping them directly into the stdin of a nested Codex subagent.
- Ingestion points: User-supplied task objectives and repository deliverables in
SKILL.md. - Boundary markers: The skill does not implement delimiters or warnings to the subagent to ignore instructions embedded within processed data.
- Capability inventory: The subagent possesses filesystem write access (defaulting to
workspace-write) and explicit network access via the--config 'sandbox_workspace_write.network_access=true'flag inscripts/run-codex-subagent.sh. - Sanitization: No escaping or validation is performed on the prompt content before it is passed to the subagent.
- [COMMAND_EXECUTION]: The skill utilizes a bash wrapper
scripts/run-codex-subagent.shto execute the externalcodexCLI utility using theexecshell command. - [PRIVILEGE_ESCALATION]: The skill documentation and script support a
danger-full-accesssandbox mode. This mode explicitly disables filesystem isolation for the autonomous subagent, allowing it to modify files outside the intended workspace (e.g., Git metadata) if authorized by the user.
Audit Metadata