codex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The “Codex Skill” runtime workflow is based on first-party local CLI/help and instructed repo-level execution/sandboxing, with any optional web/docs access (“--search”) still requiring an explicit user instruction rather than passively ingesting arbitrary outsider-authored text.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly recommends using a broad/network sandbox (--sandbox danger-full-access) and even the flag --dangerously-bypass-approvals-and-sandbox, which directs the agent to bypass security mechanisms and gain broad privileges on the host.