codex-deepseek-subagent
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches updated model catalog information from the vendor's official CDN (cdn.deepseek.com). The script parses this remote content to extract structured configuration data rather than executing the remote file directly.
- [COMMAND_EXECUTION]: Orchestrates local management tasks by invoking the codex application binary and system utilities (like security on macOS). All subprocess calls use structured argument lists, mitigating risk of command injection.
- [SAFE]: Implements robust credential handling by reading API keys from standard input and persisting them exclusively in the macOS Keychain or Windows Credential Manager. It explicitly prohibits storing secrets in configuration files, environment variables, or temporary logs.
Audit Metadata