codex-relay
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill uses platform-native tools (create_thread, send_message_to_thread) to manage tasks. It implements defensive checks such as verifying that the CODEX_THREAD_ID is set before proceeding.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes a communication channel between threads, creating an inherent surface for instruction injection via task briefs or callback messages.\n
- Ingestion points: User-specified task names and intents are used to construct the handoff brief sent to the worker thread (SKILL.md).\n
- Boundary markers: The skill explicitly instructs the agent to embed worker-specific instructions that limit the scope to a single bounded task and prohibit further task creation.\n
- Capability inventory: The skill utilizes thread management tools and workspace discovery (list_projects, read_thread).\n
- Sanitization: The skill mandates that the parent agent physically verify the worker's changes in the workspace rather than trusting the worker's reported status, effectively mitigating potential deception from a compromised sub-task.\n- [EXTERNAL_DOWNLOADS]: The README.md documentation points to the author's GitHub repository (github.com/DannyMac180/skills) for installation. These are vendor-owned resources and follow standard installation patterns for agent skills.
Audit Metadata