codex-session-controller
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves aggregating and analyzing data from other tasks via
read_threadandlist_threads, which introduces an inherent attack surface for indirect prompt injection from worker outputs. - Ingestion points: Task transcripts and project records are read using platform tools to build the coordination index.
- Boundary markers: The instructions explicitly direct the agent to prioritize the 'latest user decisions' and verify claims against authoritative records.
- Capability inventory: The skill possesses the ability to create sub-agents (
spawn_agent) and modify task metadata (codex-session-naming). - Sanitization: The skill relies on evidence-based verification steps rather than automated sanitization to process worker reports.
- [PERSISTENCE]: The 'Scheduled' mode provides a mechanism for the skill to establish periodic heartbeats using
automation_update. This is an intended feature designed for long-term project monitoring and status tracking.
Audit Metadata