codex-qa

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONOBFUSCATIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The lsp-e2e.sh script dynamically generates and executes several Node.js test scripts (e.g., path-contract-probe.mjs, auth-ownership-probe.mjs, installed-component-probe.mjs) to verify component behavior in isolation within the local worktree.- [OBFUSCATION]: The lsp-e2e.sh script uses string concatenation for certain paths and environment variables (e.g., ".omo""/evidence", "CODEX" + "_LSP_") to prevent accidental matches with internal script safety checks during self-testing.- [COMMAND_EXECUTION]: The skill executes various system commands (codex, node, bun, tmux, jq, shasum, git) and spawns background processes such as mock servers and the Codex app-server as part of its testing harness functionality.- [DATA_EXFILTRATION]: The skill accesses and hashes the user's primary Codex configuration file (~/.codex/config.toml) for the express purpose of verifying that it remains untouched throughout the QA session, providing a cryptographic proof of isolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 01:49 AM