developer-growth-analysis
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the local file
~/.codex/history.jsonl(or via$CODEX_HOME), which contains a complete history of user interactions, including thepastedContentsfield. This file often contains proprietary source code, credentials, or other sensitive information. The skill then processes this data and transmits it to an external messaging service (Slack). - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8):
- Ingestion points: Reads untrusted data from the
displayandpastedContentsfields within~/.codex/history.jsonl. - Boundary markers: None identified; the skill directly interpolates chat content into its analysis logic.
- Capability inventory: Uses
RUBE_SEARCH_TOOLSfor network access andRUBE_MULTI_EXECUTE_TOOLfor external message delivery. - Sanitization: No evidence of sanitization, filtering, or escaping for the ingested chat content before it is processed by the LLM.
- [COMMAND_EXECUTION]: Utilizes the
Rube MCPtool suite (RUBE_SEARCH_TOOLS,RUBE_MANAGE_CONNECTIONS,RUBE_MULTI_EXECUTE_TOOL) to perform external network operations, including searching HackerNews and interacting with the Slack API to send reports.
Audit Metadata