codex-review
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands that interpolate user-provided arguments, such as
gh pr view <引数>andgit worktree add tmp/worktrees/pr-<N>. This approach creates a surface for command injection if input contains shell control characters. - [PROMPT_INJECTION]: The skill processes untrusted external data (GitHub PR information and tool findings) to generate report content and summaries.
- Ingestion points: Pull Request metadata retrieved via the GitHub CLI and code review findings produced by the Codex plugin.
- Boundary markers: No explicit markers are defined to separate untrusted external content from the agent's operational instructions.
- Capability inventory: The agent possesses
Bashexecution andWritefile system permissions. - Sanitization: The instructions do not mandate sanitization or validation of the strings ingested from GitHub or the Codex tool before they are used in the agent's task context.
Audit Metadata