codex

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via the PR review workflow: terminal(... gh pr checkout 42 && codex review ...) causes Codex to read PR content (issue/PR body, comments, diffs) authored by others from GitHub at runtime, which is then ingested as readable text by Codex’s LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill runs git clone https://github.com/user/repo.git at runtime to fetch repository contents that are then fed into Codex for review/execution, meaning remote code/content can directly influence the agent's prompts and actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly encourages bypassing sandboxing/approvals via the --yolo flag and includes commands that modify the environment (global npm install, git worktrees, cloning/pushing, auto-approving file changes), which promotes disabling security controls and changing machine state.