codex-imagegen
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts, text strings, and image references, creating a potential surface for indirect prompt injection. It includes specific mitigations by utilizing single-quoted heredoc delimiters ('IMAGEGEN_BRIEF') and instructing the agent to verify that the delimiter does not exist within the user content before execution.
- Ingestion points: User-provided intent, primary request text, and input image files.
- Boundary markers: Single-quoted heredoc markers are explicitly used in the delegation script.
- Capability inventory: The skill performs subprocess execution via the codex CLI and writes files to the workspace.
- Sanitization: The instructions require a manual check for delimiter collision to prevent command breakout.
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using the codex CLI tool. It follows shell security best practices by using single-quoted heredocs to treat user prompts as data rather than executable shell code. Furthermore, it leverages tool-specific sandboxing flags, such as --sandbox workspace-write, to restrict the scope of file system modifications.
Audit Metadata