chatgpt-review
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a 'Local Codex Gate' to manage the execution of fixes. It constructs shell commands for the
codextool using a predefined template and enforces user approval modes (e.g., 'on-request') to prevent unauthorized local execution.\n- [DATA_EXFILTRATION]: While the skill manages browser profile paths and local configuration (e.g.,~/.agents/config/chatgpt-review/defaults.yaml), it includes explicit 'Hard Rules' prohibiting the transfer of secrets, credentials, or private keys. Data exfiltration risks are mitigated by separating transport and reviewer browser roles and sanitizing evidence.\n- [PROMPT_INJECTION]: The skill demonstrates a controlled approach to indirect prompt injection risks associated with processing external data.\n - Ingestion points: Reads external responses from ChatGPT (stored in
review.md) and inspects live web page content during review rounds.\n - Boundary markers: Utilizes structured templates and heredoc delimiters (
<<'PROMPT') in the 'Local Codex Gate' to separate instructions from code.\n - Capability inventory: Includes the ability to execute local commands through
codex exec, which is strictly mediated by the implementation of an approval gate.\n - Sanitization: Mandates local verification of findings before any fixes are applied and explicitly instructs the agent to ignore commands found within web page content.
Audit Metadata