codex-imagegen

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow reads local user documents (Markdown, text, or PDF files) to generate diagrams, which can contain arbitrary user or external content, making it an ingestion path of untrusted or external file text.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs the agent to execute commands using a sandbox bypass flag (-s danger-full-access), which grants unconstrained access to the host machine.