codex
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including bash, mktemp, rg, and codex to manage task execution and perform hygiene scans. Evidence is located in the Phase 3 and Phase 4 sections of SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: The skill processes repository files and user tasks which are then sent to an external model, creating a surface for indirect prompt injection. 1. Ingestion points: Local repository files and user-provided tasks processed in SKILL.md. 2. Boundary markers: Absent; the skill relies on instructional formatting rather than programmatic delimiters or isolation. 3. Capability inventory: Shell command execution and external API communication via the codex CLI as described in SKILL.md. 4. Sanitization: Includes a regex-based hygiene check to detect and scrub common credential patterns, but lacks sanitization for malicious instructions in data.
- [DATA_EXFILTRATION]: The skill is designed to send prompts and file content to a well-known external service provider (OpenAI) using the codex CLI. The skill includes a mandatory scanner to detect and prevent the accidental transmission of sensitive credentials such as API keys and private keys.
Audit Metadata