codex-thread-orchestrator
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a platform hook in
hooks/user-hooks.jsonthat executes a local Python script (scripts/compact_rehydration.py) during session start events. This script is responsible for identifying and injecting the correct orchestrator state path into the agent's reasoning context. - [INDIRECT_PROMPT_INJECTION]: The rehydration script parses
control.mdfiles within the project's.agents/workflowsdirectory to locate state information. It then generates a context injection that instructs the agent to treat these files as the "durable source of truth." - Ingestion points: The script reads
control.mdfiles located in project-specific workflow directories (SKILL.md,scripts/compact_rehydration.py). - Boundary markers: The injected message explicitly defines the file as the source of truth to prevent the agent from relying on potentially stale chat history.
- Capability inventory: The skill utilizes thread management tools (
create_thread,send_message_to_thread,set_thread_archived) to coordinate tasks. - Sanitization: The
scripts/compact_rehydration.pyscript employs a strict regular expression (^[A-Za-z0-9][A-Za-z0-9._-]*$) to validate thesession_idbefore using it in file path operations, effectively preventing path traversal attempts.
Audit Metadata