use-windows-vm-computer-use-codex
Warn
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Register-ScheduledTaskandStart-ScheduledTaskto execute commands in a different user session (interactive session vs. SSH session 0). This is a form of privilege escalation to bypass session isolation. It also mandates the use of the--yoloflag for the Codex CLI, which explicitly disables the environment's security sandbox and approval protections. - [EXTERNAL_DOWNLOADS]: The skill includes instructions to install AutoHotkey using
winget install --id AutoHotkey.AutoHotkey. While winget is a standard Windows tool, downloading and installing third-party automation software increases the attack surface. - [PROMPT_INJECTION]: The skill uses specific prompts designed to influence the behavior of the GUI agent, including instructions to ignore shell commands or UI Automation in favor of direct 'computer-use' capabilities. The instruction to use
-EncodedCommand(Base64) for PowerShell scripts can be used to obfuscate commands sent over SSH. - [DYNAMIC_EXECUTION]: The skill dynamically generates, writes, and executes AutoHotkey (
.ahk) scripts through scheduled tasks to interact with applications. This runtime script generation and execution bypasses static analysis of the automation logic.
Audit Metadata