codex-commit-review
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the 'codex-review' tool from the author's GitHub repository via npx. This tool is essential for coordinating the debate rounds and managing session state.\n- [COMMAND_EXECUTION]: The skill executes shell commands including node, git, cat, and rg. These are used to inspect the git repository, retrieve commit history, and run the background analysis processes. The skill includes explicit safety rules against running commands that modify git history.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes commit messages and repository diffs. While it lacks explicit sanitization or boundary markers for this content, the multi-step debate workflow and analytical templates provide a structured environment for processing the data.
Audit Metadata