openai-docs
Fail
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [PRIVILEGE_ESCALATION]: The SKILL.md file contains instructions for the agent to "immediately retry the same command with escalated permissions" if a dependency installation fails. This directs the agent to seek higher privileges autonomously, which is a significant security risk.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands (e.g., "codex mcp add openaiDeveloperDocs --url https://developers.openai.com/mcp\") autonomously if the required MCP server is missing. Although the URL points to a well-known service, the practice of an agent executing system-level installation commands without explicit user initiation is high-risk.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external documentation and web searches and uses it to drive agent behavior.\n
- Ingestion points: The mcp__openaiDeveloperDocs__fetch_openai_doc tool and the web search fallback in SKILL.md.\n
- Boundary markers: Absent; the instructions do not specify the use of delimiters or instructions to ignore embedded commands in the retrieved data.\n
- Capability inventory: Shell command execution (codex mcp add) in SKILL.md.\n
- Sanitization: Absent; no instructions are provided for filtering or escaping content retrieved from external sources.\n- [METADATA_POISONING]: The skill and its reference files (e.g., references/latest-model.md, references/upgrading-to-gpt-5p4.md) contain authoritative-sounding guidance for non-existent models and features such as "GPT-5.4", "gpt-oss", and "Sora-2". This deceptive content could cause the agent to provide hallucinated information as factual documentation, misleading the user.
Recommendations
- AI detected serious security threats
Audit Metadata