code-explorer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a custom command-line tool
codex-subagentusing a shell heredoc to pass task-specific context and scope. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data including task context, scope, and issue/PR numbers, which provides a surface for indirect prompt injection attacks.
- Ingestion points: Data is passed via the shell heredoc in
SKILL.mdto the subagent. - Boundary markers: Uses standard shell heredoc delimiters (
<<'EOF'), which do not provide semantic isolation for the LLM processing the content. - Capability inventory: The tool
codex-subagentis executed to trace code paths and handle specialized tasks. - Sanitization: There is no evidence of input validation, sanitization, or instructions for the agent to ignore embedded commands within the processed data.
Audit Metadata