codex-router-external-models
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the download and immediate execution of scripts from an untrusted GitHub repository by piping them directly to shell interpreters.
- Evidence (SKILL.md):
curl -fsSL https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.sh | sh -s -- --target codex --guided - Evidence (SKILL.md):
Invoke-WebRequest https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.ps1 ... | powershell.exe -NoProfile -ExecutionPolicy Bypass -File ... - [COMMAND_EXECUTION]: The skill uses high-risk command lines to manage the host system.
- Installs background services and persistent proxy processes.
- Explicitly bypasses security restrictions using
powershell.exe -ExecutionPolicy Bypass. - Modifies sensitive local configuration files at
~/.codex/config.toml. - [EXTERNAL_DOWNLOADS]: Fetches software components from untrusted external sources.
- Downloads scripts and clones code from a personal GitHub repository (
duolahypercho/codex-router) which is not a recognized trusted organization. - [PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing untrusted data from external AI providers.
- Ingestion points: Responses from external models (e.g., Kimi, DeepSeek, Grok) processed via the local proxy.
- Capability inventory: Full shell access via internal binaries (
./bin/model-router,./bin/control) and background service execution. - Sanitization: None described in the integration instructions.
- Boundary markers: Absent; instructions do not provide delimiters for untrusted model output.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/duolahypercho/codex-router/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata