heige-codex-skin-studio
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill establishes persistence by modifying system startup configurations. On macOS, it creates a LaunchAgent at
~/Library/LaunchAgents/com.heigeai.codex-skin-controller.plist. On Windows, it creates a scheduled task namedHeiGeAI_CodexSkinControllerto ensure the skin engine runs automatically upon login. - [REMOTE_CODE_EXECUTION]: The skill uses the Chrome DevTools Protocol (CDP) on port 9341 to perform code injection into the running Codex Desktop process. Using the
Runtime.evaluatemethod, it executes dynamically generated JavaScript and CSS within the target application's context to override native UI elements. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection via its AI-assisted theme creation pipeline.
- Ingestion points: Untrusted image files and user-provided prompts are ingested by
customize.commandand thegenerateThemeFromImageutility inSKILL.md. - Boundary markers: There are no explicit delimiters or warnings to ignore instructions embedded within processed data or generated image metadata.
- Capability inventory: The skill can write files to the user's library and execute code through the CDP interface.
- Sanitization: No sanitization is documented for the CSS and palette data extracted from external assets before it is evaluated in the target process.
Recommendations
- AI detected serious security threats
Audit Metadata