codex-unrestricted-mode-injector
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONMETADATA_POISONINGDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill explicitly instructs the agent to adopt an 'UNRESTRICTED' mode designed to bypass content safety filters and ignore standard operational guidelines.
- [REMOTE_CODE_EXECUTION]: The installation steps involve cloning a repository from an untrusted source ('lingbol088-spec' on GitHub) and executing a Python script ('codex-instruct.py') with full system access.
- [COMMAND_EXECUTION]: The skill code uses 'subprocess.run' to execute external shell commands and other Python scripts, creating a pathway for arbitrary command injection.
- [METADATA_POISONING]: The skill uses metadata tags such as 'bypass gpt safety filters' and 'remove codex content restrictions' to deceive the agent into operating outside of safety boundaries.
- [DATA_EXPOSURE]: The tool modifies sensitive local configuration files located in the user's home directory ('~/.codex/config.toml'), posing a risk of unauthorized configuration changes.
Recommendations
- AI detected serious security threats
Audit Metadata