codex
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires appending
2>/dev/nullto CLI commands, which suppresses the standard error stream. This action prevents the user from seeing potential errors or security-related warnings generated by thecodextool. - [PRIVILEGE_ESCALATION]: The skill facilitates the use of the
danger-full-accesssandbox mode, which is documented to allow network access and broad system permissions for the external tool. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository content, presenting a surface for indirect prompt injection. 1. Ingestion points:
codex execreads local files. 2. Boundary markers: None specified. 3. Capability inventory: Shell command execution and workspace modification. 4. Sanitization: None provided. - [METADATA_POISONING]: The skill claims to utilize "GPT-5.2", a model version that has not been released, which is misleading regarding the tool's actual technical capabilities.
- [EXTERNAL_DOWNLOADS]: The installation process involves cloning code from a non-trusted third-party repository (github.com/skills-directory).
Audit Metadata