codex
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's primary function is to transmit local repository context and prompts to an external third-party provider. This creates a data exposure surface where internal code and potentially sensitive information are sent outside the managed environment.\n- [COMMAND_EXECUTION]: The skill uses shell commands (bash) to invoke an external binary named
codex. It constructs command strings that include shell variables and HEREDOC inputs, which are used to process and transmit prompt data.\n- [REMOTE_CODE_EXECUTION]: The skill documentation explicitly instructs the agent to use the--dangerously-bypass-approvals-and-sandboxflag when encountering sandbox-related errors. Providing instructions to bypass critical security controls is a high-risk practice.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection based on the following factors:\n - Ingestion points: Repository files are read and processed directly by the
codextool as specified in the instructions (Phase 3).\n - Boundary markers: No delimiters or instructions to ignore embedded commands are specified for the prompts generated for the external model.\n
- Capability inventory: The skill has the capability to execute shell commands and transmit data to a remote service.\n
- Sanitization: A basic regex-based scan for secrets is included, but there is no mechanism to sanitize or escape data that could manipulate the external model's instructions.
Audit Metadata