codex-memory
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones the
mcncarl/codex-memoryrepository to obtain scripts and templates for the memory vault system. - [REMOTE_CODE_EXECUTION]: Executes several Python scripts downloaded from the remote repository, including
bootstrap.py,codex_memory_index.py, andcodex_memory_closeout.py, which handle system initialization and ongoing maintenance. - [COMMAND_EXECUTION]: Instructs the agent to install persistence mechanisms, specifically macOS LaunchAgents (located in
~/Library/LaunchAgents/or/Library/LaunchDaemons/) to automate periodic audit and maintenance tasks. - [COMMAND_EXECUTION]: Modifies
~/.codex/hooks.jsonto inject memory management commands into the application's event lifecycle. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it reads and processes data from a Markdown-first memory vault that may contain untrusted external content.
- Ingestion points: Markdown source files in the configured
$HOME/codex-memory-vault(referenced inSKILL.md). - Boundary markers: None explicitly defined for the search and reconciliation processes that interpolate vault data into the agent's context.
- Capability inventory: Execution of numerous maintenance scripts, Git repository operations, and file system writes (found in
SKILL.md). - Sanitization: Safety rules mention sanitizing patterns during migration and performing leak checks (
rgfor secrets), but automated sanitization of data read at runtime is not detailed.
Audit Metadata