opencodex-gateway
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a project repository from an external, unverified source (github.com/AITabby/opencodex).
- [REMOTE_CODE_EXECUTION]: The installation guide involves running 'npm install' and 'npm start' on the cloned repository, which executes code from an unverified third-party source on the local machine.
- [COMMAND_EXECUTION]: The 'Computer Use' module utilizes the 'execSync' function to execute shell commands and AppleScript ('osascript') to perform native system-level automation on macOS.
- [CREDENTIALS_UNSAFE]: The gateway automatically reads and modifies '~/.codex/config.toml', a sensitive file used by Codex Desktop to store API credentials. It also handles API keys via environment variables and exposes them through an unauthenticated local web dashboard.
- [DYNAMIC_EXECUTION]: System automation is implemented by dynamically generating and executing system commands at runtime for keyboard and mouse events.
- [INDIRECT_PROMPT_INJECTION]: The 'Vision Bridge' feature creates an attack surface by ingesting screenshots and processing them via external vision models, where the resulting text descriptions are injected directly into prompts sent to text-only models. 1. Ingestion point: VisionBridge.describeImage processes screenshot data. 2. Boundary markers: Absent. 3. Capability inventory: execSync shell execution, CGEvent UI control, and configuration file modification. 4. Sanitization: Absent.
Recommendations
- AI detected serious security threats
Audit Metadata