migrate-to-codex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Yes—this workflow reads outsider-authored free text from the user-supplied Claude Code source tree (e.g., .claude/CLAUDE.md, .claude/agents/*.md, .claude/skills/**/*.md, .mcp.json), then embeds that content into generated artifacts and migration reports that are printed/used as LLM-readable context (e.g., content = source_file.read_text() → GeneratedText(...) and report rendering).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill explicitly instructs the agent to create, edit, replace, and delete files in user targets (e.g., .codex/, .agents/, ~/.codex/) without asking, which modifies the machine state (file system) but does not request sudo, privileged system changes, or user-account creation.