codex-construction
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a specific bash command string intended for execution by the agent to launch the 'codex' tool via 'codex exec'.\n- [PRIVILEGE_ESCALATION]: The execution command includes the flag '--dangerously-bypass-approvals-and-sandbox', which explicitly instructs the system to disable built-in security sandboxing and skip user approval for potentially dangerous actions.\n- [PERSISTENCE]: The skill leverages 'nohup' and background execution ('&') to allow the command-line process to persist and continue running after the agent's immediate session context has ended.\n- [PROMPT_INJECTION]: The 'Briefing' section contains instructions for a sub-agent to ignore standard interaction patterns, such as 'unattended single-round session' (无人值守的单轮会话) and 'no need to submit plans or report in progress' (不必先交计划或中途汇报), which reduces visibility and oversight of the agent's actions.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes untrusted external input from 'BRIEF_FILE' and pipes it directly into the 'codex exec' tool. Evidence:\n
- Ingestion points: 'BRIEF_FILE' read via stdin (SKILL.md)\n
- Boundary markers: Absent\n
- Capability inventory: Full shell execution and filesystem access with sandbox bypass enabled (SKILL.md)\n
- Sanitization: None described for the input briefing content.
Recommendations
- AI detected serious security threats
Audit Metadata