delegate
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
codex execcommand for automated code implementation and exploration. This includes instructions for using high-capability flags such as--dangerously-bypass-approvals-and-sandboxto allow for non-interactive execution and workspace modifications. - [EXTERNAL_DOWNLOADS]: The documentation instructs users to install the
@openai/codexCLI tool from the npm registry. This dependency is a core component of the skill and is provided by a well-known service (OpenAI). - [PROMPT_INJECTION]: The skill's orchestration architecture creates an indirect prompt injection surface where a manager agent ingests and acts upon reports generated by subagents.
- Ingestion points: Subagent reports (labeled with CHANGES, VERIFIED, GAPS, OBJECTIONS) and results stored in
findings/*.mdare incorporated into the primary session context. - Boundary markers: The skill employs structured reporting headers and explicit instructions for delegates to object to conflicting specifications rather than silently complying.
- Capability inventory: The system possesses high-impact capabilities including filesystem write access through
codex execand shell command execution through thecodex-workeragent. - Sanitization: The skill mitigates risks through a mandatory 'Verify' phase, requiring the orchestrator to perform independent diff reviews and manually re-run validation tests rather than trusting subagent reports as ground truth.
- [SAFE]: The skill includes a local setup script (
scripts/setup-roster.sh) that automates the installation of subagent definition files. The script is limited to standard, benign file system operations.
Audit Metadata