shunk031-codex-worker-prompting
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The
SKILL.mdfile contains an instruction in a note block requiring the agent to output a specific message ("🤖 I read shunk031-codex-worker-prompting") immediately after reading the content. This is a form of behavioral override intended to confirm the skill's presence.\n- [DATA_EXFILTRATION]: The instructions inSKILL.mdreference a sensitive file path,~/.agents/AGENTS-private.md, as a location for private instructions. While the skill itself does not perform file operations or network transfers, it encourages the use of another skill expected to access this potentially sensitive configuration file.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for generating task prompts for worker models based on user requirements, which presents an indirect prompt injection surface:\n - Ingestion points: User-provided task requirements are used to generate worker dispatches as described in
SKILL.md.\n - Boundary markers: The guidelines lack instructions for using delimiters or boundary markers to isolate untrusted user input within the generated worker prompts.\n
- Capability inventory: No active code capabilities (subprocess, file-write, network) are present in the provided skill files.\n
- Sanitization: There are no instructions for sanitizing or escaping user-provided data before it is interpolated into the worker prompts.
Audit Metadata