codex
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions specify that the agent should 'Complete tasks without seeking approval for each step' and 'proceed autonomously' for the majority of tasks, which is a direct attempt to bypass safety guidelines and human oversight.\n- [COMMAND_EXECUTION]: The integration defines a 'Danger-Full-Access' flag that grants the agent network and system-level permissions, significantly increasing the potential impact of malicious or erroneous commands.\n- [METADATA_POISONING]: The skill uses deceptive triggers and references non-existent models like 'gpt-5.2', which may lead the agent to invoke the skill for inappropriate tasks or rely on exaggerated capabilities.\n- [EXTERNAL_DOWNLOADS]: The skill references the installation of the
@openai/codexpackage via the NPM registry and thecodexformula via Homebrew.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and process external codebases which could contain malicious instructions.\n - Ingestion points: Reads files in the workspace for analysis and modification (SKILL.md).\n
- Boundary markers: None identified.\n
- Capability inventory: Full file system access, network access, and system-level command execution via the
danger-full-accessmode.\n - Sanitization: No sanitization or validation of the processed code is mentioned.
Audit Metadata