soia-env-codex-install
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/inspect_installation.py uses subprocess.run to verify the existence, version, and login status of the Codex CLI. These commands are diagnostic in nature and limited to verifying the tool's installation environment.
- [EXTERNAL_DOWNLOADS]: The skill references official installation channels, including the OpenAI-owned chatgpt.com domain for shell scripts and the @openai/codex package from the npm registry. These are verified sources for the software being managed.
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to install the CLI using a remote shell script. This execution is performed from a trusted vendor's official URL and is necessary for the skill's primary function.
- [DATA_EXPOSURE]: Security measures are in place to ensure that authentication tokens and API keys are not processed, stored, or logged by the skill, instead delegating authorization to the official browser-based flow.
Audit Metadata