codex-computer-use
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Bash command template (
codex exec ... "<brief>") that interpolates a user-generated or file-derived 'brief' directly into a shell string. Using double quotes in this context does not prevent command injection if the brief contains shell metacharacters such as backticks or subshell expansion syntax. - [DATA_EXFILTRATION]: The instructions mandate enabling network access (
sandbox_workspace_write.network_access=true) within a sandbox that is otherwise restricted. While intended for local development server access, this configuration allows the execution environment to reach external endpoints, increasing the risk of data leakage. - [PROMPT_INJECTION]: The skill implements a workflow where data from a repository ('verification brief') is passed to an external execution tool (Codex). This creates an indirect prompt injection surface; if the repository contains malicious files, the agent might incorporate attacker-controlled instructions into the brief, leading to unauthorized actions by the Codex tool.
- Ingestion points: Data enters the process via the 'brief' constructed from the repository root (SKILL.md).
- Boundary markers: None present; instructions do not advise on delimiters or sanitization for the brief content.
- Capability inventory: The skill uses shell execution (Bash), file system output (mktemp), and network access.
- Sanitization: None observed; the brief is interpolated directly into the command line.
Audit Metadata