openai-codex
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references official installation scripts from
chatgpt.comand packages fromnpmjs.comand Homebrew. These are trusted sources for the described product. - [REMOTE_CODE_EXECUTION]: Includes standard one-liner installation commands that pipe remote scripts to shell interpreters. These are targeted at trusted OpenAI domains and are standard for the tool's deployment.
- [COMMAND_EXECUTION]: Provides numerous CLI command examples for interacting with the Codex agent, configuring environments, and performing code reviews. All examples represent legitimate tool features.
- [CREDENTIALS_UNSAFE]: Mentions the use of environment variables like
CODEX_ACCESS_TOKENand local storage for credentials inauth.json. The skill explicitly warns users to handle these secrets securely and avoid exposing them. - [SAFE]: No malicious patterns, obfuscation, or unauthorized data access mechanisms were identified within the skill's instructions or samples.
Audit Metadata