chatgpt-codex-onboarding
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to manage the OAuth lifecycle, including initiating authentication flows, polling for status, and interacting with local runtime management APIs to refresh the agent's model list.
- [EXTERNAL_DOWNLOADS]: Initiates network requests to official OpenAI authorization endpoints to facilitate the device-code login process and retrieve subscription-specific metadata such as available models and usage stats.
- [SAFE]: Implements security best practices for handling sensitive temporary data, such as using atomic file replacements and setting restricted file permissions (0o600) for the local OAuth state file.
Audit Metadata