codex-candy-eval-benchmark
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an untrusted GitHub account:
https://github.com/haowang02/codex-candy-eval.git. - [REMOTE_CODE_EXECUTION]: The instructions promote running the downloaded script
codex_candy_eval.py. Executing code from external sources that are not verified or trusted is a significant security risk. - [COMMAND_EXECUTION]: The skill's code examples utilize
subprocess.runto execute shell commands, which increases the impact potential if the externally sourced code is malicious.
Recommendations
- AI detected serious security threats
Audit Metadata