media-codex-image
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via the
codex executility. This interface allows the agent to call the internalimage_gentool for gpt-image-2 processing. - [EXTERNAL_DOWNLOADS]: The instructions require the installation of the
@openai/codexpackage from the official npm registry. This is a public tool provided by a well-known organization. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image descriptions and parameters which are then interpolated into shell commands.
- Ingestion points: User-provided text for image subjects, styles, and quality settings in
SKILL.mdexamples. - Boundary markers: The skill suggests using quotes around the
codex execarguments, but does not specify advanced escaping for shell metacharacters. - Capability inventory: The skill uses shell execution capabilities to run the
codexCLI. - Sanitization: There is no explicit description of input sanitization or filtering for the generated shell commands.
Audit Metadata