codex-session-patcher
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is explicitly designed to bypass safety guardrails of other AI tools. It includes triggers and functions to "avoid AI refusal," "clean AI refusal responses," and "inject CTF prompts."
- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to clone a repository from
github.com/ryfineZ/codex-session-patcher.git, which is an unverified third-party source. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from session files (chat history) and feeds it into an LLM to generate "context-aware replacements," creating a surface for indirect injection.
- Ingestion points: Local session files (JSONL, SQLite) from Codex, Claude Code, and OpenCode (referenced in
SKILL.md). - Boundary markers: No evidence of delimiters or sanitization warnings for the processed session data.
- Capability inventory: Modifies local configuration and session files, performs network operations to AI endpoints.
- Sanitization: No sanitization or validation of the session content is documented before it is sent to the LLM.
- [CREDENTIALS_UNSAFE]: The skill's configuration schema (
config.json) and API usage examples include fields for storing and handling plain-text API keys (ai_key). - [COMMAND_EXECUTION]: The skill requires the execution of multiple installation commands (
pip install,npm install,npm run build) on code fetched from an external, untrusted source.
Audit Metadata