codex-dispatcher
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically identifies and executes a local binary (codex) using bash scripts. In Step 4, it constructs a command string that includes several variables and a user-provided $TASK_PROMPT.
- [REMOTE_CODE_EXECUTION]: Through its 'full' sandbox mode, the skill facilitates high-risk operations such as dependency installation and script execution via the external Codex tool.
- [EXTERNAL_DOWNLOADS]: The skill relies on an external, unverifiable dependency ('Codex CLI') that must be pre-installed on the user's system, which is not part of the skill's distributed files.
- [DATA_EXFILTRATION]: Project details and task instructions are passed as arguments to the codex utility, which typically transmits this data to external AI service providers.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection and command injection. Ingestion points: User input enters the system through the $TASK_PROMPT variable in SKILL.md (Step 4). Boundary markers: No delimiters are used to prevent the agent from interpreting embedded instructions. Capability inventory: Shell execution of the local binary with interpolated arguments in SKILL.md. Sanitization: No evidence of escaping shell metacharacters in the prompt before interpolation.
Audit Metadata