codex-explain
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code content through the
${CODE_CONTENT}variable and analyzes it using a suite of tools including Bash and Write, which provides an attack surface for indirect prompt injection. - Ingestion points: File contents are read into the agent context in the
references/codex-prompt-explain.mdfile. - Boundary markers: While markdown blocks are used, there are no specific guardrails instructing the agent to ignore commands embedded in the code.
- Capability inventory: The skill is configured with Read, Grep, Glob, Bash, and Write tools.
- Sanitization: Escaping logic is provided for filenames in research commands, but not for the file content being explained.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute research commands via shell. Although the prompt includes strong recommendations for safe command construction using single quotes and escaping to prevent injection from filenames, the dynamic execution of shell commands based on file content and structure is a known risk vector.
Audit Metadata