project-skill-audit
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories containing session history and memory files, specifically
~/.codex/sessionsand~/.codex/memories. These directories store logs of user interactions and project data. Additionally, the skill instructions include a hardcoded absolute path (/Users/dimillian/.codex/...) that exposes specific local environment information including a username.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources such as past session logs, rollout summaries, and repository-local skill files.\n - Ingestion points: The agent reads data from
MEMORY.md, rollout summaries inmemories/rollout_summaries/, raw session JSONL files insessions/, and local skill definitions in.agents/skills/or.codex/skills/.\n - Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from executing instructions that may be embedded in the historical session logs or repository files.\n
- Capability inventory: The skill possesses file system read access and the ability to execute searches using the
rgcommand.\n - Sanitization: There is no mechanism described for sanitizing or filtering content retrieved from these external files before processing.\n- [COMMAND_EXECUTION]: The skill instructs the agent to utilize the
rg(ripgrep) system utility to search through local memory and session files.
Audit Metadata