exploring-codex-sessions
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process local session logs (~/.codex/sessions/*.jsonl) which contain historical conversation data. This data is external to the immediate prompt and could contain malicious instructions intended to influence the agent's behavior during exploration.
- Ingestion points: The skill reads transcript data from JSONL files, a metadata index from a SQLite database (
/.codex/state_5.sqlite), and a prompt history file (/.codex/history.jsonl). - Capability inventory: The skill leverages Bash tools including
sqlite3,jq,rg,find, and thecodexCLI for querying, searching, and managing files. - Boundary markers: While the skill provides extraction logic, it does not define explicit boundary markers or instructions to the agent to ignore potentially malicious embedded content within the extracted transcripts.
- Sanitization: The instructions include specific guidance and filters to identify and exclude harness injections and system-generated blocks (e.g.,
<environment_context>,<permissions instructions>,## Memory) to isolate human messages. - [COMMAND_EXECUTION]: The skill utilizes several local command-line utilities to interact with the filesystem and process data. This includes a destructive command recipe (
codex delete <SESSION> --force) which allows the agent to permanently remove local session files.
Audit Metadata