setup-codex-devcontainer
Warn
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill grants the devcontainer elevated administrative privileges by adding
--cap-add=SYS_ADMIN,--security-opt=seccomp=unconfined, and--security-opt=systempaths=unconfinedto the container'srunArgs. This significantly reduces the security isolation between the container and the host kernel. - [EXTERNAL_DOWNLOADS]: Fetches the Codex CLI installer from an official OpenAI domain (
https://chatgpt.com/codex/install.sh). - [REMOTE_CODE_EXECUTION]: The installer script is executed directly using
shduring the container's post-creation phase (post-create.sh). - [PERSISTENCE]: Modifies the user's
~/.bashrcfile to inject acodex-yoloalias, ensuring the tool's specialized execution mode remains available across terminal sessions. - [COMMAND_EXECUTION]: The skill utilizes shell scripts (
patch-if-absent.sh,patch-json-array-if-absent.sh) to modify system configuration files and scripts idempotently. - [INDIRECT_PROMPT_INJECTION]: The skill sync feature establishes a data ingestion pipeline that fetches skills from external sources into the
~/.agents/skillsdirectory, creating a vulnerability surface for third-party instructions. - Ingestion points: External agent skills synced via
npx -y skills add <source>during the container's post-start phase. - Boundary markers: None implemented for the ingested skill content.
- Capability inventory: The Codex tool and the devcontainer shell have broad execution capabilities, including file and network access.
- Sanitization: External content is synced and potentially executed without mandatory human review or integrity verification.
Audit Metadata