codex-cli-best-practice
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation provides examples for exporting API keys using restricted prefixes such as
sk-andghp_. While used as placeholders, these follow patterns associated with sensitive credentials. - [EXTERNAL_DOWNLOADS]: The installation guide suggests cloning a repository from an untrusted GitHub account (
shanraisshan) and usingnpxto fetch packages from unverified sources. - [REMOTE_CODE_EXECUTION]: The configuration examples for MCP servers utilize
npx -yto download and execute packages directly from the npm registry at runtime. - [COMMAND_EXECUTION]: The skill makes extensive use of shell hooks and MCP server definitions that allow the execution of arbitrary system commands, including shell scripts and language interpreters.
- [DYNAMIC_EXECUTION]: The skill documents a workflow involving the execution of dynamically invoked Python scripts and shell hooks to process information and control agent behavior.
- [INDIRECT_PROMPT_INJECTION]: The weather-fetching subagent example ingests data from an external API, creating an injection surface.
- Ingestion points: Fetches data from
https://api.open-meteo.com/v1/forecast. - Boundary markers: The example instructions lack delimiters or warnings to ignore embedded instructions in the API response.
- Capability inventory: The agent can execute scripts and shell commands based on the data received.
- Sanitization: No sanitization or validation logic is provided for the external data in the examples.
Audit Metadata