codex-dispatch
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the '@openai/codex' package using npm. This is identified as a vendor-owned resource from a trusted organization (OpenAI) and is documented neutrally per security guidelines.
- [COMMAND_EXECUTION]: The skill includes bash commands used to set up and interact with the Codex companion script, specifically 'node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" setup'.
- [DYNAMIC_EXECUTION]: Shell commands utilize environment variables like 'CLAUDE_PLUGIN_ROOT' to dynamically construct paths to executable scripts at runtime.
- [PROMPT_INJECTION]: The skill contains internal rules for behavior, such as 'adversarial-review' instructions, which guide the model to be more critical during code reviews. These are functional instructions aligned with the skill's purpose and do not attempt to bypass safety guardrails.
Audit Metadata