codex-session-patcher
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is explicitly designed to override AI safety guardrails, using triggers like 'bypass ai refusal' and 'patch ai refusal responses'. It provides configuration templates for 'CTF/pentest prompt injection' which aim to bypass safety filters by framing interactions as authorized security research.\n- [EXTERNAL_DOWNLOADS]: The installation instructions require cloning a repository from an untrusted GitHub account ('https://github.com/ryfineZ/codex-session-patcher.git') and executing the code via 'pip install' and 'npm install'.\n- [INDIRECT_PROMPT_INJECTION]: The skill automates the creation of workspace configuration files designed to influence agent behavior through hidden context.\n
- Ingestion points: Project-level files 'CLAUDE.md' (Claude Code) and 'AGENTS.md' (OpenCode) that are automatically read by the respective tools.\n
- Boundary markers: Absent; templates do not include delimiters or warnings to separate injected instructions from user content.\n
- Capability inventory: Includes session file modification (JSONL and SQLite), shell command execution (pip, npm, uvicorn), and network access to external AI endpoints.\n
- Sanitization: Absent; system prompts are injected into workspace files without escaping or validation.\n- [COMMAND_EXECUTION]: The skill instructs users to run various shell commands for environment configuration, dependency installation, and launching local web servers using uvicorn and custom scripts.
Recommendations
- AI detected serious security threats
Audit Metadata