codex-worker

Warn

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to dynamically manage git worktrees and orchestrate tmux sessions for parallel task execution.
  • [PRIVILEGE_ESCALATION]: The instructions require the use of the --dangerously-bypass-approvals-and-sandbox flag when invoking the codex CLI. This flag disables critical security guardrails, including the requirement for human approval of actions and the sandbox environment that restricts the agent's capabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data by spawning sub-agents for triage and refactoring tasks.
  • Ingestion points: Sub-agents ingest external data including GitHub issue descriptions, linting results, and source code files.
  • Boundary markers: No delimiters or explicit instructions to ignore embedded commands are used when passing data to sub-agents.
  • Capability inventory: Sub-agents have shell access and file system access within their respective worktrees, operating without a security sandbox.
  • Sanitization: The skill does not perform sanitization or validation of the external content before it is processed by the worker agents.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 17, 2026, 09:36 AM
Security Audit — agent-trust-hub — codex-worker