openai-agents-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of SandboxAgent for executing shell and filesystem tools. It provides explicit security guidance, noting that the UnixLocalSandboxClient does not provide strong OS-level confinement on Linux and network isolation is limited on macOS, advising developers to use suitably isolated backends for untrusted commands.
- [DATA_EXFILTRATION]: Technical guidance is provided regarding the SDK's default tracing behavior, which may include sensitive generation or tool data. The skill includes instructions on how to disable tracing via environment variables (OPENAI_AGENTS_DISABLE_TRACING=1) or configure the RunConfig to exclude sensitive data from traces.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing untrusted data which presents an indirect injection surface. Ingestion points: Data enters the agent context via Runner.run and Runner.run_streamed (e.g. SKILL.md). Boundary markers: The skill describes the use of input/output guardrails in references/guardrails.md to establish execution boundaries. Capability inventory: The agent can execute Python functions via function_tool and shell commands via SandboxAgent. Sanitization: Instructions recommend using failure_error_function to sanitize tool error messages and stress that authorization must be handled in application code.
- [REMOTE_CODE_EXECUTION]: While describing the capability to run code via sandbox tools, the skill focuses on secure implementation. It warns against blindly copying demo defaults and recommends verifying client configurations on target hosts to ensure proper access limits and cleanup.
Audit Metadata