chronicle
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to access highly sensitive local data, including rolling screen recordings stored in the $TMPDIR directory and summarized activity history in the user's home directory (~/.codex/memories/). This behavior is the primary intended function of the skill.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks because it processes untrusted text content captured from the user's screen.\n
- Ingestion points: Untrusted data is ingested from screen images and Apple Vision OCR history files (*.ocr.jsonl).\n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between screen-captured text and system instructions.\n
- Capability inventory: The agent can execute shell commands (rg, date) and is instructed to pass extracted information (such as document IDs) to other app-specific skills or connectors.\n
- Sanitization: No validation or sanitization of text extracted from the screen is mentioned or performed.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to utilize standard CLI tools, specifically ripgrep (rg) for searching OCR sidecars and the date command for verifying recording freshness.\n- [EXTERNAL_DOWNLOADS]: The documentation includes a reference to the official OpenAI GitHub repository for the Codex project as a resource for memory implementation.
Audit Metadata