codex-mcp-server-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the '@openai/codex' package globally and run 'codex-mcp-server' using npx. While the scoped package relates to a well-known service, the MCP server is an external dependency provided by a third-party author.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface for indirect prompt injection attacks.\n
- Ingestion points: Untrusted data enters the agent context through the 'context' parameter (local files) and the 'websearch' tool (external web results).\n
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested content.\n
- Capability inventory: The 'codex' tool includes a 'sandbox' parameter with a 'workspace-write' mode, which allows the AI to modify or create files in the user's workspace based on instructions that could be influenced by malicious data.\n
- Sanitization: No sanitization or validation of external content is specified before interpolation into the prompt.\n- [COMMAND_EXECUTION]: The setup process requires the manual execution of shell commands for installation and authentication, including 'npm install', 'npx', and 'codex login', the latter of which handles sensitive API keys via environment variables.
Audit Metadata