qp-setup
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by reading and acting upon instructions from external repository files.
- Ingestion points: The skill reads configuration and instructions from
$CODEX_HOME/AGENTS.md,<repo>/AGENTS.md, and<repo>/.codex/config.tomlto determine agent behavior and host settings (refer toreferences/codex-host.md). - Boundary markers: It utilizes managed blocks delimited by
<!-- qp-setup:start -->and<!-- qp-setup:end -->to separate its modifications, though it still parses surrounding content for overrides and cleanup. - Capability inventory: The skill is capable of performing file writes, executing tool installation/removal scripts, and modifying system environment variables (refer to
references/tool-setup.md). - Sanitization: The skill implements robust human-in-the-loop controls, requiring manual diff verification, explicit permission for all writes, and automated byte-for-byte backups before any file modification.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to perform system-level operations related to tool lifecycle management.
- Operations include installing, configuring, and removing persistent services and engineering tools, which may involve administrative privileges.
- Security controls: It explicitly restricts the agent from performing privileged or global installations without distinct authority and mandates the use of native authentication mechanisms rather than requesting secrets in chat (refer to
references/tool-setup.md). It also includes a reference to OpenAI's official configuration documentation for validation.
Audit Metadata