codex-coding-plugin
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific host CLI tools for version verification and integration testing. These commands are localized to the development environment and are standard for the described purpose. Evidence includes usage of
projectatlas --format json runtime-info,opencode --version, andclaude mcp get projectatlas. - [SAFE]: The skill provides explicit safety guidance, instructing the agent to filter out unrelated environment variables from host debug output to prevent unintentional data exposure. It also promotes robust coding practices by requiring structured JSON parsing for configuration files.
- [SAFE]: Surface analysis for data ingestion: The skill processes local configuration files (.json) using host-provided source paths and official vendor checks, minimizing the risk of processing malicious data. Ingestion points include
.codex-plugin/plugin.json,.claude-plugin/plugin.json, andopencode/opencode.json. Boundary markers are established via official source verification logic, and capabilities are limited to local configuration and host CLI operations. Sanitization is enforced through the mandatory use of structured JSON parsers rather than string manipulation.
Audit Metadata