codex-plugin-cc
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
@openai/codexglobal npm package. Since this package belongs to a well-known and trusted service provider (OpenAI), the download is considered safe and appropriate for the skill's functionality.\n- [DYNAMIC_CONTEXT_INJECTION]: The fileSKILL.mdincludes a dynamic context injection pattern!codex login. This is used as an authentication step to link the user's Codex account. In this context, it is a benign setup command rather than a malicious injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data by reviewing repository code and diffs. This creates an attack surface where malicious instructions embedded in code comments could influence the agent's behavior.\n - Ingestion points: Local source code, uncommitted changes via
/codex:review, and branch diffs.\n - Boundary markers: The skill does not define specific delimiters or "ignore instructions" prompts to separate code from instructions during the review process.\n
- Capability inventory: The skill executes the
codexCLI and delegates tasks to a subagent (codex:codex-rescue) capable of bug investigation and patching.\n - Sanitization: There is no mention of sanitizing or filtering input code before it is processed by the Codex model.\n- [COMMAND_EXECUTION]: The skill relies on executing the
codexcommand-line tool for its core operations, including reviews, task delegation, and job status management.
Audit Metadata