codex-advisor
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
ask_codex.mjsscript executes thecodexCLI tool usingspawnSync, which depends on external software being installed in the environment. - [DATA_EXFILTRATION]: The skill retrieves the recent conversation transcript and sends it to an external LLM provider via the Codex CLI. This constitutes a transfer of session context, which may contain sensitive code or data, to a third-party service.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted session history into the model's prompt.
- Ingestion points: The script reads transcript records from a file provided via the
--transcriptargument. - Boundary markers: Delimiters like
<recent-conversation>are used but do not provide robust protection against malicious instructions embedded in the context. - Capability inventory: The skill can execute the
codexCLI with system input. - Sanitization: The conversation data is clipped for length but undergoes no sanitization or escaping.
Audit Metadata