update-codex-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Command Execution]: The skill executes several shell commands and local scripts to manage the update process. It runs a TypeScript helper using
node --experimental-strip-typesto query version availability. It utilizes theazCLI (az account get-access-token) to retrieve an authentication token for the private Azure DevOps feed. The script is designed to use this token only for headers and explicitly avoids logging it. It performsnpm installwith the--ignore-scriptsflag, which is a recommended security measure to prevent the execution of potentially unsafe lifecycle scripts during package installation. It executes project-specific test suites (./scripts/test.sh,npm run test-agent-host-e2e) to validate the new dependency version. - [Network Operations]: The skill interacts with the Microsoft Azure DevOps registry (
pkgs.dev.azure.com) to retrieve package metadata. This is a legitimate operation within the context of the repository's build system and the vendor's infrastructure.
Audit Metadata