media-codex-image

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands via the codex exec utility. This interface allows the agent to call the internal image_gen tool for gpt-image-2 processing.
  • [EXTERNAL_DOWNLOADS]: The instructions require the installation of the @openai/codex package from the official npm registry. This is a public tool provided by a well-known organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image descriptions and parameters which are then interpolated into shell commands.
  • Ingestion points: User-provided text for image subjects, styles, and quality settings in SKILL.md examples.
  • Boundary markers: The skill suggests using quotes around the codex exec arguments, but does not specify advanced escaping for shell metacharacters.
  • Capability inventory: The skill uses shell execution capabilities to run the codex CLI.
  • Sanitization: There is no explicit description of input sanitization or filtering for the generated shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 01:41 PM
Security Audit — agent-trust-hub — media-codex-image