claude-codex-dispatch
Warn
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes an installation script from 'https://claude.ai/install.sh'. This targets the official domain for Anthropic's Claude service.
- [COMMAND_EXECUTION]: Executes various local CLI commands including 'claude', 'node', 'grep', and 'cat' to manage background tasks, verify system status, and read configuration files.
- [REMOTE_CODE_EXECUTION]: Executes a local JavaScript file ('codex-companion.mjs') using a shell glob pattern to resolve the path within a plugin directory. Execution from dynamically computed paths can be used to run unintended code if the environment is manipulated.
- [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by acting as a conduit for passing prompts between different AI agents.
- Ingestion points: Untrusted data enters the agent context through the '' argument used in background Claude sessions and the '[prompt]' argument or '--prompt-file' used with the Codex companion script.
- Boundary markers: Prompts are wrapped in quotes for shell execution, but there are no instructions for the receiving agent to ignore or delimit embedded commands within that content.
- Capability inventory: The skill leverages subprocess execution ('claude', 'node') to initiate tasks based on these prompts across multiple reference files.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the prompt content before it is dispatched to the target provider.
Audit Metadata