codex-exec
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill provides specific prompt templates that instruct the agent to ignore its default interaction protocols, such as "do not present a plan or ask for confirmation" and "make completion authority explicit".
- [COMMAND_EXECUTION]: The skill invokes the codex CLI and executes a local shell script located at plugins/review-anvil/skills/review-anvil/scripts/run-reviewer.sh.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files and documentation through a delegated agent, creating an attack surface for indirect prompt injection where instructions embedded in the codebase could manipulate the reviewer.
- Ingestion points: Local source code files, directory structures, and planning documents (e.g., PLAN.md).
- Boundary markers: None identified; instructions do not include delimiters or warnings to ignore instructions within the reviewed content.
- Capability inventory: Shell command execution via the codex tool and the run-reviewer.sh script.
- Sanitization: No sanitization or content validation is performed on the files before they are passed to the reviewer agent.
Audit Metadata