openai-codex

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation references official installation scripts from chatgpt.com and packages from npmjs.com and Homebrew. These are trusted sources for the described product.
  • [REMOTE_CODE_EXECUTION]: Includes standard one-liner installation commands that pipe remote scripts to shell interpreters. These are targeted at trusted OpenAI domains and are standard for the tool's deployment.
  • [COMMAND_EXECUTION]: Provides numerous CLI command examples for interacting with the Codex agent, configuring environments, and performing code reviews. All examples represent legitimate tool features.
  • [CREDENTIALS_UNSAFE]: Mentions the use of environment variables like CODEX_ACCESS_TOKEN and local storage for credentials in auth.json. The skill explicitly warns users to handle these secrets securely and avoid exposing them.
  • [SAFE]: No malicious patterns, obfuscation, or unauthorized data access mechanisms were identified within the skill's instructions or samples.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 03:02 AM
Security Audit — agent-trust-hub — openai-codex