use-codex
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents tools ('codex' and 'codex-reply') that execute shell commands on the host environment.
- [COMMAND_EXECUTION]: Explicit instructions in SKILL.md and references/tool-specs.md describe how to bypass manual approval for command execution using the 'approval-policy: never' parameter.
- [COMMAND_EXECUTION]: The skill documents 'sandbox: danger-full-access' in references/tool-specs.md, granting complete access to the host filesystem and system resources.
- [PROMPT_INJECTION]: The skill facilitates Indirect Prompt Injection through its ingestion of external data. 1. Ingestion points: The 'prompt' parameter in 'codex' and 'codex-reply' calls in SKILL.md. 2. Boundary markers: No markers or 'ignore' instructions are provided to separate user data from commands. 3. Capability inventory: The tools can write to the workspace and execute shell commands with full system access. 4. Sanitization: No input validation or sanitization of the 'prompt' parameter is mentioned.
Audit Metadata