codex-session-controller
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to access session history and task records stored on the local filesystem under $CODEX_HOME/sessions (defaulting to ~/.codex/sessions). This access is used to verify task identities and rollout states when standard tool-based reads are incomplete.
- [INDIRECT_PROMPT_INJECTION]: The skill operates as a routing hub that ingests natural language reports from other workers (AI tasks). This ingestion creates an attack surface where instructions embedded in worker outputs could influence the controller's decision-making.
- Ingestion points: Data enters the context via the read_thread tool and local filesystem access to session records.
- Boundary markers: The instructions mention establishing boundaries for safety and permissions, but do not specify technical delimiters for worker content.
- Capability inventory: The agent has the ability to create new threads, send messages to existing threads, and update thread titles.
- Sanitization: The skill implements a verification process requiring workers to provide specific evidence (such as tool calls, commit hashes, or test results) before their completion claims are accepted.
Audit Metadata