codex-qa
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONOBFUSCATIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The
lsp-e2e.shscript dynamically generates and executes several Node.js test scripts (e.g.,path-contract-probe.mjs,auth-ownership-probe.mjs,installed-component-probe.mjs) to verify component behavior in isolation within the local worktree.- [OBFUSCATION]: Thelsp-e2e.shscript uses string concatenation for certain paths and environment variables (e.g.,".omo""/evidence","CODEX" + "_LSP_") to prevent accidental matches with internal script safety checks during self-testing.- [COMMAND_EXECUTION]: The skill executes various system commands (codex,node,bun,tmux,jq,shasum,git) and spawns background processes such as mock servers and the Codex app-server as part of its testing harness functionality.- [DATA_EXFILTRATION]: The skill accesses and hashes the user's primary Codex configuration file (~/.codex/config.toml) for the express purpose of verifying that it remains untouched throughout the QA session, providing a cryptographic proof of isolation.
Audit Metadata