codex
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts and repository files to drive the execution of the Codex CLI, creating a surface for potential instruction injection.
- Ingestion points: User prompts and repository data are ingested via the
codex execandcodex resumecommands (SKILL.md). - Boundary markers: The agent is directed to use
AskUserQuestionto confirm next steps and explicitly verify high-impact flags likedanger-full-access(SKILL.md). - Capability inventory: The skill executes shell commands to invoke the Codex CLI with multiple sandbox tiers, including read-only and full-access modes (SKILL.md).
- Sanitization: The skill mandates using quoted heredocs (
<<'EOF') for passing prompt content to the CLI, effectively preventing shell command injection (SKILL.md).
Audit Metadata