codex-cli-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Interpolation Surface: The skill uses a pattern where the agent is instructed to invoke a script using
node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" task "<raw arguments>". While the script is internal, the interpolation of user-provided content into a shell command represents a potential consideration for command injection if the agent does not properly escape metacharacters when populating the<raw arguments>placeholder. - Indirect Prompt Injection Surface: The instructions define the agent as a "forwarder" whose job is to pass user requests to an external tool with minimal modification. It explicitly instructs the agent to "Preserve the user's task text as-is" and "Do not inspect the repo... or add independent analysis." This transparent forwarding model lacks boundary markers or sanitization steps, making it a surface for indirect prompt injection where instructions embedded in the task text are passed directly to the underlying runtime.
Audit Metadata