codex-router-media
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute a CLI binary (
mediaormodel-router.ps1) located at a path dynamically derived from a local manifest file. - [DATA_EXFILTRATION]: The skill accesses configuration paths in the user's home directory (
~/.codex/codex-router/install-manifest.json) to determine the installation root, which involves reading sensitive local filesystem metadata. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input for prompts, lyrics, and speech text which is then interpolated into shell commands, creating a potential surface for command injection or manipulation.
- Ingestion points: Arguments for the
--prompt,--lyrics, and--textflags in themediacommand provided in the skill instructions. - Boundary markers: The skill recommends wrapping the prompt in double quotes, but provides no instructions for escaping or sanitizing user-supplied characters that might break the shell context.
- Capability inventory: The skill utilizes the agent's
shelltool to execute the vendor CLI. - Sanitization: No sanitization, validation, or filtering of user-provided content is specified before the strings are interpolated into the final shell command.
Audit Metadata