goalify
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands and a custom Rust binary to manage goal files. It performs environmental checks (e.g.,
test -x /usr/local/bin/codex-goal) before proceeding to ensure the necessary environment is set up. Command execution is restricted to the specific task of writing and protecting goal files. - [PRIVILEGE_ESCALATION]: The skill requires the installation of a privileged helper via
sudo. However, this is implemented as a security feature (using the Linux immutable flag to protect agent goals). The installation process is transparent, requires explicit user consent, and uses a narrow/etc/sudoers.d/rule that permits only the specific helper binary to run as root without a password, minimizing the attack surface. - [SAFE]: The installation script
script/install-codex-goal.shimplements several security best practices, including verifying the SHA256 checksum of the binary, ensuring files are root-owned and non-writable by others, and refusing to overwrite existing unrelated files. It also uses a wrapper script to pin thePATHto system directories, preventing basic path injection attacks.
Audit Metadata