codex-review
Warn
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: MEDIUMPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to review source code, creating a surface for indirect prompt injection where malicious content in the code could influence agent behavior.
- Ingestion points: Reads external source code and refactoring diffs for review (SKILL.md).
- Boundary markers: No delimiters or instructions to ignore embedded instructions are specified for handling the untrusted input.
- Capability inventory: The skill description identifies 'auto CHANGELOG generation' as a feature, which requires file system write access to project files.
- Sanitization: No input validation, filtering, or escaping of external content is described.
- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to download the skill from an unverified GitHub repository ('BenedictKing/codex-review') that does not belong to a recognized trusted organization.
- [COMMAND_EXECUTION]: The skill requires the 'Codex CLI' to be installed and executed on the host system, which involves running external software within the agent's execution environment.
Audit Metadata