update-codex-sdk

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The skill executes several shell commands and local scripts to manage the update process. It runs a TypeScript helper using node --experimental-strip-types to query version availability. It utilizes the az CLI (az account get-access-token) to retrieve an authentication token for the private Azure DevOps feed. The script is designed to use this token only for headers and explicitly avoids logging it. It performs npm install with the --ignore-scripts flag, which is a recommended security measure to prevent the execution of potentially unsafe lifecycle scripts during package installation. It executes project-specific test suites (./scripts/test.sh, npm run test-agent-host-e2e) to validate the new dependency version.
  • [Network Operations]: The skill interacts with the Microsoft Azure DevOps registry (pkgs.dev.azure.com) to retrieve package metadata. This is a legitimate operation within the context of the repository's build system and the vendor's infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 07:22 PM
Security Audit — agent-trust-hub — update-codex-sdk