gpt-engineer
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestration scripts (run_codex_agent.py, cache_gates.py, run_journal.py) interact with the local operating system via subprocess to manage Git repositories and invoke the Codex CLI. These operations are core to the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted repository content. To mitigate risks, it uses explicit boundary markers in its prompts and a defensive redaction system in run_journal.py to prevent sensitive data like API keys and tokens from being stored in cleartext logs.
- [SAFE]: Several security-positive patterns were identified:
- Secret Redaction: A centralized redact function in run_journal.py actively searches for and masks credential patterns (e.g., sk-, access_token, etc.) before persisting state.
- Sandbox Hardening: In run_codex_agent.py, the Codex execution environment is explicitly hardened when performing writes, including the disabling of network access (network_access=false).
- Safe File Operations: The skill uses os.O_NOFOLLOW and os.fsync for atomic and safe file updates, and applies restrictive permissions (e.g., 0700 and 0600) to its private state directories.
- Isolated Candidates: Implementation tasks are performed in a temporary Git worktree (candidate-worktree) to isolate the primary repository from unauthorized or erroneous changes during implementation.
Audit Metadata