codex-worker
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to dynamically manage git worktrees and orchestrate tmux sessions for parallel task execution.
- [PRIVILEGE_ESCALATION]: The instructions require the use of the --dangerously-bypass-approvals-and-sandbox flag when invoking the codex CLI. This flag disables critical security guardrails, including the requirement for human approval of actions and the sandbox environment that restricts the agent's capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data by spawning sub-agents for triage and refactoring tasks.
- Ingestion points: Sub-agents ingest external data including GitHub issue descriptions, linting results, and source code files.
- Boundary markers: No delimiters or explicit instructions to ignore embedded commands are used when passing data to sub-agents.
- Capability inventory: Sub-agents have shell access and file system access within their respective worktrees, operating without a security sandbox.
- Sanitization: The skill does not perform sanitization or validation of the external content before it is processed by the worker agents.
Audit Metadata