ask-codex
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local CLI tool named
codexvia the Bash shell. It uses theexecsubcommand to process coding queries and tasks, including options that allow the tool to automatically modify the workspace. - [PROMPT_INJECTION]: The skill accepts arbitrary user instructions and passes them directly to the
codextool, creating a vulnerability to indirect prompt injection. - Ingestion points: User-provided queries are passed as arguments to the
codex execcommand inSKILL.md. - Boundary markers: The skill lacks delimiters or explicit instructions to the agent to ignore embedded commands within the user data.
- Capability inventory: The
codextool can perform code generation and workspace-write operations (specifically when the--full-autoflag is used). - Sanitization: No validation, escaping, or filtering is performed on the user input before it is passed to the underlying shell command.
Audit Metadata