codex-analyze-session
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts, which are untrusted external data sources that may contain malicious instructions.
- Ingestion points: The transcript files (JSONL) are read line-by-line by
session.pyand used throughout the skill's workflow defined inSKILL.mdandpreflight.sh. - Boundary markers: Analysis prompts for delegated agents in
references/VERIFY_FIGURES.mdandreferences/FIX_SURFACES.mddo not utilize robust delimiters or 'ignore instructions' wrappers when presenting transcript-derived claims to sub-agents. - Capability inventory: The skill has the ability to write to the local filesystem (retrospective creation in
new-retro.sh), execute shell commands via local scripts (session.py), and spawn delegated agents for verification and synthesis tasks. - Sanitization: The content of the transcript (specifically reasoning blocks and tool outputs) is not sanitized or escaped before being presented to the agent or sub-agents for evaluation, allowing embedded instructions to potentially influence model behavior.
Audit Metadata