codex-subagent

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow (SKILL.md) constructs a prompt from the user’s stated objective/deliverables and pipes it on stdin into the Codex CLI subagent via scripts/run-codex-subagent.sh (stdin → codex ... exec -), so outsider-authored free text is ingested directly at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly documents and permits a "danger-full-access" sandbox override that removes filesystem sandboxing for the nested process, enabling writes outside the workspace and therefore potential modification of system/system-level files — a clear path to compromising machine state.