codexdesktop-rebuild-electron
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone a project repository from GitHub (
https://github.com/Haleclipse/CodexDesktop-Rebuild.git) and install development dependencies using the Node Package Manager (NPM). - [COMMAND_EXECUTION]: The documentation includes commands for building and running the application, such as
electron-forge start,electron-forge make, and cross-platform builds using Docker. It also provides a pattern for Inter-Process Communication (IPC) that allows the renderer process to trigger shell command execution in the main process. - [DYNAMIC_EXECUTION]: The skill outlines the use of Vite for dynamic development serving and the use of
@electron/rebuildto compile native Node.js modules for the Electron environment. - [INDIRECT_PROMPT_INJECTION]: The application architecture involves taking user-provided text from a webview and executing it as a command, creating an attack surface where untrusted data could influence system commands.
- Ingestion points: Input is gathered from a textarea element in the renderer process (described in
src/webview/main.js). - Boundary markers: The provided code snippets do not specify any delimiters or boundary markers to separate instructions from data.
- Capability inventory: The skill documentation includes scripts for file system modification (
patch-copyright.js) and IPC handlers for shell command execution (execute-codex-command). - Sanitization: The provided examples do not demonstrate sanitization or validation of the input before it is passed to the command execution logic.
Audit Metadata