codex-review-pr-description
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a shell script located at
.agents/skills/codex-pr/scripts/record-review.shto clear and record review states. This script is a local resource presumably associated with the 'tbhb' vendor ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill's core function is to process untrusted data from a repository's pull request environment, creating a vulnerability surface where malicious content could influence the agent's verdict.
- Ingestion points: The skill reads
PR_AGENTDESC.md, commit messages from<base>..HEAD, and the name-status/diff from<base>...HEAD. These are frequently controlled by external contributors. - Boundary markers: There are no explicit markers (like triple-backticks or XML tags) or instructions to ignore embedded commands within the ingested data, which increases the risk of the agent obeying instructions hidden in a PR description.
- Capability inventory: The skill has access to shell execution (
bash), allowing it to perform local system operations based on its analysis. - Sanitization: The instructions do not specify any sanitization, filtering, or validation steps for the external content before it is processed by the model.
Audit Metadata