codex-agent-creator

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The skill defines procedures to quarantine prompt injection from untrusted sources like web content and logs. Test fixtures in references/evals.yaml contain injection-like phrases (e.g., 'ignore previous instructions') for validation purposes, which are benign in this context.
  • [COMMAND_EXECUTION]: The skill performs local validation using audit tools and repo-specific validators. These operations are restricted to the intended task of confirming configuration integrity.
  • [DATA_EXFILTRATION]: Instructions mandate the redaction of secrets, credentials, and private identifiers from outputs. The skill is scoped to local repository configuration.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection due to the processing of untrusted external data. Evidence chain: 1. Ingestion points: Reads data from ~/.agents/session-collector and third-party role files. 2. Boundary markers: The skill instructs the agent to quarantine injections and treat external session text as untrusted. 3. Capability inventory: The skill has file-write permissions for .codex/config.toml and .codex/agents/*.toml. 4. Sanitization: The instructions require redaction of sensitive data and hashing of identifiers in logs.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 09:50 AM
Security Audit — agent-trust-hub — codex-agent-creator