codex-thread-orchestrator

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines a platform hook in hooks/user-hooks.json that executes a local Python script (scripts/compact_rehydration.py) during session start events. This script is responsible for identifying and injecting the correct orchestrator state path into the agent's reasoning context.
  • [INDIRECT_PROMPT_INJECTION]: The rehydration script parses control.md files within the project's .agents/workflows directory to locate state information. It then generates a context injection that instructs the agent to treat these files as the "durable source of truth."
  • Ingestion points: The script reads control.md files located in project-specific workflow directories (SKILL.md, scripts/compact_rehydration.py).
  • Boundary markers: The injected message explicitly defines the file as the source of truth to prevent the agent from relying on potentially stale chat history.
  • Capability inventory: The skill utilizes thread management tools (create_thread, send_message_to_thread, set_thread_archived) to coordinate tasks.
  • Sanitization: The scripts/compact_rehydration.py script employs a strict regular expression (^[A-Za-z0-9][A-Za-z0-9._-]*$) to validate the session_id before using it in file path operations, effectively preventing path traversal attempts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 09:02 PM
Security Audit — agent-trust-hub — codex-thread-orchestrator