codex-cli
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to process and act upon external repository code. Ingestion points: Repository files read by the agent (SKILL.md). Boundary markers: Sandbox modes such as read-only and workspace-write, along with scoped prompt briefs (SKILL.md). Capability inventory: The 'codex exec' command can write to the file system and access the network (SKILL.md). Sanitization: Reliance on sandbox backends, policy enforcement, and manual user verification of output diffs and test outcomes (SKILL.md).
- [COMMAND_EXECUTION]: The skill contains instructions for invoking the 'codex' CLI tool. It promotes security best practices by advising the agent to adhere to user-defined configurations and avoid requesting high-risk permissions like 'danger-full-access' or bypassing sandbox approvals autonomously.
Audit Metadata