lisa-codex-parity
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to drive the codex CLI and execute build or test commands using bun. Evidence includes direct commands like 'codex exec -c mcp_servers={} ...' and 'bun run build'.
- [CREDENTIALS_UNSAFE]: Accesses the ~/.codex/ directory, which is a sensitive path that often contains configuration and authentication data for the Codex service. The agent is specifically instructed to inspect this path in Step 2 of the protocol.
- [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting and processing untrusted data from repository source files and CLI outputs.
- Ingestion points: Repository source files in plugins/src/, user configuration in ~/.codex/, and runtime capture output stored in /tmp/ files.
- Boundary markers: The protocol lacks explicit instructions for using delimiters or boundary markers when processing these external data sources.
- Capability inventory: The skill has access to Bash, Read, Write, Edit, Glob, and Grep tools.
- Sanitization: There are no defined sanitization or validation steps for the content ingested from the filesystem or external tool outputs.
Audit Metadata