manual-interacting-with-codex-via-cli
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents and provides examples for using powerful bypass flags such as
--dangerously-bypass-approvals-and-sandboxanddanger-full-access. These instructions enable the agent to override default safety sandboxes and approval workflows. - [CREDENTIALS_UNSAFE]: The guidelines demonstrate how to provide sensitive credentials like
CODEX_API_KEYandOPENAI_API_KEYthrough environment variables when invoking CLI commands. While it advises against printing these values, this pattern of credential injection into shell environments can lead to exposure in process lists or logs. - [EXTERNAL_DOWNLOADS]: The skill includes instructions for extending functionality by adding MCP servers using
npx, specifically referencing@upstash/context7-mcpfrom a well-known technology provider. - [PROMPT_INJECTION]: The skill defines a workflow where the agent processes external repository data and executes commands based on that content, creating an attack surface for indirect prompt injection where hidden instructions in files could influence agent behavior.
- Ingestion points: Processes repository content, file data, and metadata through
codex execcommands as described in SKILL.md. - Boundary markers: Recommends the use of
--jsonoutput formats and--output-last-messageartifacts to structure results. - Capability inventory: Possesses significant capabilities for command execution, file system modification, and network access via the
codexutility. - Sanitization: Suggests using isolated worktrees, temp directories, and manual verification of file diffs to mitigate unintended changes.
Audit Metadata