project-skill-audit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to read sensitive local files located in
~/.codex/sessions/and~/.codex/memories/. These files contain historical logs of agent interactions, which may include sensitive data, credentials, or private project logic. While this access is required for the skill's primary purpose (auditing), it creates an exposure surface where an agent could be manipulated into leaking this historical data. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources including past sessions, rollout summaries, and project-specific documentation (e.g.,
README.md,AGENTS.md). There is a risk that malicious instructions embedded in these files could influence the agent's behavior during the audit process. - Ingestion points: Reads from
$CODEX_HOME/sessions/,$CODEX_HOME/memories/, and project-local files likeREADME.md,AGENTS.md, and existing skill definitions. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing this data.
- Capability inventory: The skill uses file-read capabilities and the
rg(ripgrep) tool to search through the collected data. - Sanitization: There are no instructions for sanitizing or validating the content retrieved from sessions or project files before it is processed by the agent.
Audit Metadata