codex-harness
Fail
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes a PowerShell script from a trusted official domain using 'irm | iex' during the installation process.
- [PRIVILEGE_ESCALATION]: Instructions explicitly set 'sandbox_mode' to 'danger-full-access' and 'approval_policy' to 'never' in the configuration file, removing all safety constraints for subsequent operations.
- [PRIVILEGE_ESCALATION]: The installation and environment setup use 'powershell -ExecutionPolicy Bypass' to run scripts and modify system path variables.
- [COMMAND_EXECUTION]: The skill promotes the use of the '--dangerously-bypass-approvals-and-sandbox' flag when executing Codex tasks, which allows for unmonitored and unrestricted system operations by the AI.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a high-privilege execution surface by passing untrusted prompts directly to the Codex CLI. Ingestion points: Prompts passed to 'codex exec' in SKILL.md. Boundary markers: None present to delimit untrusted instructions. Capability inventory: Full host access via 'danger-full-access' sandbox mode in all scripts. Sanitization: No validation or escaping of external content before interpolation.
Recommendations
- AI detected serious security threats
Audit Metadata