codex-agent-creator
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill defines procedures to quarantine prompt injection from untrusted sources like web content and logs. Test fixtures in references/evals.yaml contain injection-like phrases (e.g., 'ignore previous instructions') for validation purposes, which are benign in this context.
- [COMMAND_EXECUTION]: The skill performs local validation using audit tools and repo-specific validators. These operations are restricted to the intended task of confirming configuration integrity.
- [DATA_EXFILTRATION]: Instructions mandate the redaction of secrets, credentials, and private identifiers from outputs. The skill is scoped to local repository configuration.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection due to the processing of untrusted external data. Evidence chain: 1. Ingestion points: Reads data from ~/.agents/session-collector and third-party role files. 2. Boundary markers: The skill instructs the agent to quarantine injections and treat external session text as untrusted. 3. Capability inventory: The skill has file-write permissions for .codex/config.toml and .codex/agents/*.toml. 4. Sanitization: The instructions require redaction of sensitive data and hashing of identifiers in logs.
Audit Metadata