codex
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a command-line interface tool called
codexto execute tasks and handle background processing. - Evidence: Use of commands like
codex exec -m gpt-5.6-sol "reply OK"and backgrounding patternscodex exec ... </dev/null &. - [EXTERNAL_DOWNLOADS]: The skill is designed to send local context and code diffs to external providers (specifically OpenAI) for processing.
- Evidence: Instructions in
REFERENCE.mddescribe authorization gates for sending code to OpenAI and cross-provider review mechanisms. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository data and objectives to generate prompts for external execution, which presents a surface for instructions embedded in local files to influence the delegated agent.
- Ingestion points: Repository content, branch names, objectives, and scope definitions.
- Boundary markers: The skill uses a "Prompt contract" to define scope and exclusions, and instructs the agent to "exclude secrets."
- Capability inventory: The skill has the ability to execute shell commands via
codex execand write output to local paths. - Sanitization: It requires verifying citations, commands, and conclusions before integration.
Audit Metadata